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September 30, 2008 

PREFACE 

We are providing this interagency report for your information and use. This 
review was conducted as a cooperative effort by the Offices of Inspector General (OIGs) 
of the Departments of Agriculture, Commerce, Defense, Energy, Homeland Security, 
State, and the Treasury; the Central Intelligence Agency; and the United States Postal 
Service. 

Public Law 106-65, “National Defense Authorization Act for FY 2000,” requires 
that the Inspectors General of the Departments of Commerce, Defense, Energy, and 
State, in consultation with the Directors of Central Intelligence and the Federal Bureau of 
Investigation, 1 conduct an annual review, not later than March 30 th of each year 
beginning in the year 2000 and ending in the year 2007, on the adequacy of export 
control policies and procedures in the U.S. Government. 

This report satisfies our eighth and final statutory reporting requirement under the 
“National Defense Authorization Act for FY 2000,” as amended. The report focuses on 
whether management effectively addressed recommendations from previous reports 
required by the Act. 2 This report discusses issues that affect more than one agency and 
includes separate appendixes containing the agency-specific reports. The report is in 
three volumes: 

• Volume I contains the findings, recommendations, and reports from the 
Departments of Commerce, Defense, Energy, State, the Treasury, and the 
United States Postal Service OIGs. 

• Volume II, marked For Official Use Only, contains the report that the 
Department of Homeland Security OIG issued, and a detailed followup report 
on recommendations made in previous years by the OIGs. 

• Volume III, classified as Secret, contains the agency-specific report issued by 
the Central Intelligence Agency OIG, as well as an appendix to the 
Department of Commerce OIG’s report. 

There are no interagency recommendations in this year’s report; therefore, 
management comments are not required. However, we requested management comments 
on agency-specific draft reports from the appropriate officials and, when provided, we 
considered them in preparing this report. Management comments provided in response to 
individual agency reports are included in those reports. 

This interagency report is required by Congress and will support Congress and the 
Administration in shaping future Federal licensing policies and procedures for U.S. 
exports to countries and entities of concern. 


1 The Federal Bureau of Investigation does not play an active role in the licensing process for export- 
controlled technology and therefore did not participate in this interagency review. 

2 The Commerce OIG also conducted a separate review of U.S. dual-use export controls for India. 
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Interagency Review of Prior Inspector General 
Recommendations Related to U.S. Export Controls 


Executive Summary 


Background 

The United States controls the export of dual-use commodities 1 and munitions 2 for 
national security and foreign policy purposes under the authority of several laws, 
primarily the Export Administration Act of 1979 3 and the Arms Export Control Act of 
1976. Commodities are subject to the licensing requirements contained in the Export 
Administration Regulations for dual-use commodities or the International Traffic in 
Arms Regulations for munitions. 

From 2000 through 2006, 9 Offices of Inspector General (OIGs) 4 participated in issuing 
9 interagency reports and 40 agency-specific reports on U.S. export controls. The OIGs 
made 273 recommendations in these 49 reports to improve Federal export control 
policies and procedures. This report provides the status of Federal managers’ 
implementation of those recommendations. 

Objective 

The main objective of the 2007 review was to determine whether management effectively 
addressed recommendations in previous reports required by the National Defense 
Authorization Act. 5 


1 Dual-use commodities can be used for commercial or military purposes. 

2 Munitions can be military weapons, ammunition, and equipment. 

3 The Export Administration Act expired in August 1994. However, the President, under the authority of 
the International Emergency Economic Powers Act (section 1702, title 50, United States Code), 
continued the provisions of the Export Administration Act through Executive Order 13222, 
“Continuation of Export Control Regulations,” August 17, 2001. On August 3, 2006, the President 
issued a notice, “Continuation of Emergency Regarding Export Control Regulations,” extending 
Executive Order 13222. 

4 The Department of Agriculture OIG made two recommendations in March 2005. These 
recommendations were implemented by the Department of Agriculture. Therefore, the Department of 
Agriculture OIG determined that a followup review and report were not needed. 

5 The Department of Commerce OIG also conducted a separate review of U.S. dual-use export controls for 
India. 



Review Results 


To satisfy the final National Defense Authorization Act reporting requirement, the 
Inspectors General of the Departments of Commerce, Defense, Energy, Homeland 
Security, State, and the Treasury; the Central Intelligence Agency; and the United States 
Postal Service followed up to determine whether management effectively addressed 
export control recommendations made pursuant to the National Defense Authorization 


This interagency review determined that 234 of the recommendations (85.6 percent) 
made to Federal managers from 2000 through 2006 were implemented (closed). 6 
However, Federal managers needed to take additional actions to implement the 
39 remaining (open) recommendations. These 39 recommendations remained open from 
1 to 7 years. The following chart summarizes the status of recommendations made by the 
interagency OIGs from 2000 to 2006 to control exports. 

I Status of Recommendations Related to U.S. Export Controls I 


(From 2000 through 2006) 



Number of 
Recommendations* 

Office of Inspector General 

of 

Reports 

Closed 

Open 

Total 

Interagency 

9 


6 

1 

7 

Department of Agriculture 

■jl 

1 

2 

0 

2 

Department of Commerce 


7 

131** 

19 

150 

Department of Defense 


7 

29 

10 

39 

Department of Energy 


7 

14 

3 

17 

Department of Homeland Security 


3 

5 

2 

7 

Department of State 


7 

28 

1 

29 

Department of the Treasury 


3 

15 

2*** 

17 

Central Intelligence Agency 


4 

1 

1 

2 

United States Postal Service 


1 

3 

0 

3 

Total 


40 

234 

39 

273 


'The numbers shown for closed and open recommendations are as of the date of publication of the report for each agency. For 
further detail on the closed or open status, refer to the agency-specific report recommendations in Volume II of this report. 
"Some recommendations were closed although the recommendations were not implemented. 

'"These recommendations were made to Treasury bureaus that have been transferred to the Department of Homeland 
Security. 


The results of followup work performed and the status of recommendations as 
determined by the OIGs at Commerce, Defense, Energy, Homeland Security, State, the 
Treasury, the Central Intelligence Agency, and the United States Postal Service follow. 

The Commerce OIG’s review of U.S.-India export control activities identified the 
following concerns that warranted management’s attention: 

• Dual-use export control policies and practices for India were not fully transparent. 


6 The interagency review focused on the implementation of recommendations as of December 31, 2006. 




• Bureau of Industry and Security’s end-use check program in India needed to be 
improved. 

• Bureau of Industry and Security needed to enhance its efforts to ensure 
compliance with license conditions. 

With regard to prior Commerce OIG recommendations made from 2000 to 2006 related 
to export controls, Commerce OIG found that the Bureau of Industry and Security has 
taken action to address 87 percent of the recommendations. However, several key 
recommendations from its reports on Export Control Automated Support System 
moderni z ation efforts (February 2002), deemed export controls (March 2004), chemical 
and biological export licensing (March 2005), and China export controls (March 2006) 
remained open. In addition, one recommendation from the March 2002 interagency 
report on federal automated export licensing systems was still open. All 
recommendations from Commerce OIG’s March 2000 and 2001 reports were closed. 

Given the current interest in the Committee on Foreign Investment in the United States 
both within and outside of the U.S. government, Commerce OIG followed up on its 
March 2000 report findings and recommendations related to selected aspects of the 
Committee on Foreign Investment in the United States’ monitoring of foreign investment 
for national security reasons. While questions still remain about the effectiveness of the 
overall Committee on Foreign Investment in the United States process, Commerce OIG 
noted that considerable improvements have been made with regard to Committee 
activities within Commerce. 

It should also be noted that based on its follow-up work, Commerce OIG reopened its 
recommendation related to the Bureau of Industry and Security working with the U.S. 
Postal Service to increase interagency cooperation and coordination in identifying 
potential violations of dual-use export control laws. 

The Defense OIG found that Department of Defense (DoD) organizations implemented 
29 of 39 (74.3 percent) of the recommendations made in 7 reports issued from FY 2000 
through FY 2006. However, those organizations needed to fully implement the 
10 remaining recommendations. One recommendation remained unimplemented for 
7 years. 

The Defense OIG made the 39 recommendations to strengthen controls over and reduce 
the risk of the inappropriate export of goods, services, and technologies such as 
chemicals, toxins, explosives, electronics, sensors, and lasers. Until the recommended 
controls are implemented, DoD continues to accept avoidable risks of inappropriately 
exporting sensitive goods, services, and technology that could threaten our national 
security. 

The Energy OIG reported that of 17 prior recommendations, 14 were closed as of the end 
of 2006. The open recommendations concerned the dissemination of export control 
guidance across the Energy complex and access to and training on Commerce’s Export 
Control Automated Support System. 

The Department of Homeland Security OIG determined that five of the seven 
recommendations addressed in three reports issued from 2000 through 2006 were closed. 
For the two open recommendations, one is related to immigrant applications for approval, 
and the other is related to Customs and Border Protection staffing. 

iii 



The Department of State OIG found that the Bureau of Political-Military Affairs, 
Directorate of Defense Trade Controls, had implemented 28 of the 29 recommendations 
contained in OIG reports on export controls issued from 2000 to 2006. The OIG’s 
recommendation from its 2006 report that the Bureau of Political-Military Affairs, 
Directorate of Defense Trade Controls should establish performance measures that detail 
benchmarks and timeframes for reducing and eliminating the number of unfavorable 
post-license end-use checks remains unresolved. Nevertheless, the Bureau of Political- 
Military Affairs, Directorate of Defense Trade Controls stated that over the next year it 
would consider whether such measures, along with time-lines and benchmarks, would be 
of value in its compliance and licensing functions. As a result, this recommendation will 
remain unresolved until the Bureau of Political-Military Affairs, Directorate of Defense 
Trade Controls makes its final determination. 

The Treasury Department OIG determined that the 3 recommendations directed to 
current Treasury Departmental offices were implemented and are now closed. 

The Central Intelligence Agency OIG reported that in response to prior export audit 
recommendations, the Central Intelligence Agency’s Office of Transnational Issues 
Military Security Group (the Military Security Group) is developing a working 
relationship with the Department of State’s Directorate of Defense Trade Controls (the 
Directorate) concerning the conventional weapons export market. According to a 
Directorate representative, meetings between the Military Security Group and the 
Directorate have been positive and the Directorate is satisfied with the developing 
relationship with the Military Security Group. The Central Intelligence Agency OIG is 
aware that the Military Security Group and the Directorate are drafting a new 
memorandum of understanding, but the Central Intelligence Agency OIG’s 2006 audit 
recommendation will remain open until the new memorandum of understanding is signed 
by both parties. 

The United States Postal Service OIG concluded that the Postal Service has taken actions 
to address the three recommendations made in 2003. However, the Postal Service OIG 
encouraged the Postal Service to continue to work with Customs and Border Protection 
to expand and implement a nationwide outbound mail inspection program to search 
outbound mail and ensure compliance with export administration regulations. 

Followup on Previous Interagency Reviews 

As required by the National Defense Authorization Act for FY 2001, Appendix I 
(Volume II) provides details on recommendations from previous years’ agency-specific 
and interagency reports. 

Recommendations and Management Comments 

There are no interagency recommendations in this year’s report; therefore, management 
comments are not required. The participating OIGs made recommendations specific to 
their own agencies. Recommendations, management comments, and OIG responses are 
included in the separate reports that each office issued. They may be found in 
Appendix B-l and B-2 (Commerce), Appendix C (Defense), Appendix D (Energy), 
Appendix E (State), Appendix F (Treasury), Appendix G (United States Postal Service), 
and Appendix H (Homeland Security). Appendixes B, C, D, E, F, and G are in Volume I, 
and Appendix H is in Volume II. A status report on recommendations from previous 
interagency reviews is in Volume II. Appendixes J and K, in Volume III, contain the 



classified results of work completed by the Central Intelligence Agency and the 
Department of Commerce. 
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Background 


The United States controls the export of dual-use commodities 1 and munitions 2 
for national security and foreign policy purposes under the authority of several 
laws, primarily the Export Administration Act of 1979 3 and the Arms Export 
Control Act of 1976. Commodities are subject to the licensing requirements 
contained in the Export Administration Regulations for dual-use commodities or 
the International Traffic in Arms Regulations for munitions. 

Public Law 106-65, “National Defense Authorization Act for FY 2000,” requires 
that the Inspectors General of the Departments of Commerce, Defense, Energy, 
and State, in consultation with the Directors of Central Intelligence and the 
Federal Bureau of Investigation, conduct an annual review of the adequacy of 
export control policies and procedures in the U.S. Government. In addition, the 
Public Law requires the annual review be conducted not later than March 30 th of 
each year beginning in the year 2000 and ending in the year 2007. An 
amendment to the National Defense Authorization Act for FY 2001 requires the 
Inspectors General to report on the status of recommendations made in prior 
annual reports. 

To comply with the first-year requirement of the Act, the OIGs conducted 
agency-specific and interagency reviews of compliance with license requirements 
for releasing export-controlled technology to foreign nationals in the United 
States. Also, the OIGs reviewed Government actions to protect against the illicit 
transfer of U.S. technology through select intelligence, counterintelligence, and 
foreign investment reporting and enforcement activities. We issued two 
interagency reports to fulfill the first-year requirement of the Act: Report No. D- 
2000-109, “Interagency Review of the Export Licensing Process for Foreign 
National Visitors,” issued on March 24, 2000, and Report No. 00-OIR-05, “(U) 
Measures to Protect Against the Illicit Transfer of Sensitive Technology,” issued 
on March 27, 2000. 

To meet the second-year requirement of the Act, the OIGs conducted an 
interagency review to assess policies and procedures for developing, maintaining, 
and revising the Commerce Control List and the U.S. Munitions List. The 
interagency report, D-2001-092, “Interagency Review of the Commerce Control 
List and the U.S. Munitions List,” was issued in March 2001. 

To achieve the third-year requirement of the Act, the OIGs conducted an 
interagency review of the Federal automation programs that support the export 
licensing and enforcement process. That interagency report, D-2002-074, 


1 Dual-use commodities can be used for commercial or military purposes. 

2 Munitions can be military weapons, ammunition, and equipment. 

3 Although the act expired on August 21, 2001, the President extended existing export regulations under 
Executive Order 13222, dated August 17, 2001, invoking emergency authority under the International 
Emergency Economic Powers Act. 
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“Interagency Review of Federal Automated Export Licensing Systems,” was 
issued in March 2002. 

To accomplish the fourth-year requirement of the Act, the OIGs conducted an 
interagency review of U.S. Government actions to enforce export controls and 
prevent or detect the illegal transfer of militarily sensitive technology to countries 
and entities of concern. That interagency report, D-2003-069, “Interagency 
Review of Federal Export Enforcement Efforts,” was issued in April 2003. 

To complete the fifth-year requirement of the Act, the OIGs conducted an 
interagency review on the release of export-controlled technology to: 

• foreign nationals at U.S. academic institutions, 

• Federal contractors and other private companies, and 

• research facilities. 

That interagency report, D-2004-062, “Interagency Review of Foreign National 
Access to Export-Controlled Technology in the United States,” was issued in 
April 2004. 

To attain the sixth-year requirement of the Act, the OIGs conducted an 
interagency review to assess whether the current export licensing process could 
help deter the proliferation of chemical and biological commodities. An 
interagency report, D-2005-043, “Interagency Review of the Export Licensing 
Process for Chemical and Biological Commodities,” was issued on June 10, 2005. 

For the seventh-year requirement of the Act, the OIGs conducted an interagency 
review of controls over exports to China. An interagency report, D-2007-050, 
“Interagency Review of U.S. Export Controls For China,” was issued on January 
31,2007. 

For the eighth and final year’s requirement of the Act, the OIGs followed up on 
Federal managers’ implementation of the recommendations made from FY 2000 
through FY 2006. 


Responsibilities of Federal Entities Related to U.S. Export 
Controls 


Agriculture. The Public Health Security and Bioterrorism Preparedness and 
Response Act of 2002, Title II, Subtitle B, was enacted to enhance controls over 
dangerous biological agents or toxins. The Act requires that the Secretary of 
Agriculture, through regulations, establish and maintain a list of each biological 
agent and each toxin that is determined to have the potential to pose a severe 
threat to animal or plant health, or to animal or plant products. It also requires 
that the Secretary establish procedures to protect animal and plant health and 
animal and plant products in the event of a transfer of biological agents. 


2 



The Animal and Plant Health Inspection Service (APHIS) was delegated authority 
to administer the regulations for the U.S. Department of Agriculture. The Public 
Health Security and Bioterrorism Preparedness and Response Act of 2002 did not 
address exports. 

Commerce. The Department of Commerce’s Bureau of Industry and Security 
(BIS) administers the Export Administration Regulations by developing export 
control policies and regulations, issuing export licenses, and enforcing the laws 
and regulations for dual-use exports. After BIS conducts its initial review, a 
license application is referred to the Defense, Energy, and State departments, 
unless those agencies have delegated their decision-making authority to the 
Department of Commerce. 

If the application involves an item controlled for reasons relating to the protection 
of encryption technologies, Commerce also refers it to the Justice Department. In 
addition, prior to 2008 BIS referred all export license applications to the Central 
Intelligence Agency’s Center for Weapons Intelligence, Nonproliferation, and 
Arms Control (WINPAC) for an end-user review. 

Defense. Although the Departments of Commerce and State are responsible for 
issuing export licenses, the Department of Defense reviews license applications 
and recommends approval, approval with conditions, or denial of licenses 
involving dual-use and munitions commodities or technology. The Defense 
Technology Security Administration (DTSA) serves as the Department’s focal 
point for processing license applications and advises the Under Secretary of 
Defense for Policy on issues related to the transfer of sensitive technology and the 
export of dual-use items and munitions. DTSA also assists in developing export 
control policies and procedures that are necessary to protect U.S. national security 
interests. 

Energy. The Energy Department’s Office of International Regimes and 
Agreements reviews license applications and recommends approval, approval 
with conditions, or denial of licenses. Energy reviews licenses involving nuclear, 
chemical, biological, and missile dual-use and munitions commodities or 
technology referred to it by the Commerce and State Departments. Also, 

Energy’s Office of Foreign Visits and Assignments establishes Energy policies 
for the review and processing of visits and assignments by foreign nationals to 
Energy. 

Homeland Security. As an enforcement arm at U.S. ports for the State and 
Commerce Departments, the Department of Homeland Security’s Customs and 
Border Protection (CBP) is responsible for ensuring that licensable exports are 
processed in accordance with applicable laws and regulations. CBP uses the 
Immigration and Customs Enforcement Exodus Command Center as a liaison 
with the State and Commerce Departments to answer questions that may arise as 
to whether a shipment is licensable. CBP officers are directed to send any such 
questions to the Exodus Command Center for resolution. 

State. Under the Arms Export Control Act, the State Department’s Bureau of 
Political-Military Affairs, Directorate of Defense Trade Controls (PM/DDTC) 
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administers the International Traffic in Arms Regulations (ITAR). The Bureau of 
Political-Military Affairs administers the ITAR by: 

• developing export control policies, 

• registering companies and academic institutions to export munitions, 

• issuing licenses and compliance provisions, and 

• maintaining the U.S. Munitions List. 

Also, the State Department reviews munitions export licenses and approves, 
conditionally approves, or disapproves an applicant’s license, including those 
related to the release of export-controlled technology to foreign nationals in the 
United States. 

Treasury. The Office of Foreign Assets Control (OFAC) administers and 
enforces economic and trade sanctions against targeted foreign countries, 
terrorism sponsoring organizations and international narcotics traffickers, based 
on U.S. foreign policy and national security goals. OFAC regulations require 
exporters, importers, and others under U.S. jurisdiction to obtain OFAC licenses 
prior to engaging in any type of commercial transactions with targeted countries 
or nationals. 

Central Intelligence Agency. During fiscal year 2006, the Central Intelligence 
Agency (CIA) provided intelligence support to the Department of Commerce on 
dual-use license applications and to the Department of State on munitions license 
applications. CIA analysts reviewed comprehensive intelligence records to 
provide information to these agencies that will assist them with making decisions 
to approve or deny licenses. 

In 2006, the Department of Commerce’s BIS submitted license applications to the 
Directorate of Intelligence’s WINPAC for review. In addition, to providing 
intelligence support to BIS, WINPAC analysts and experts were also actively 
involved in export licensing advisory and oversight groups. As of 1 October 
2007, WINPAC scaled back its level of export license application support to the 
Department of Commerce due to budget constraints. WINPAC personnel will 
continue to support the export licensing advisory and oversight groups, but will 
review export license applications only when requested by a member of the 
dispute resolution committees. 

United States Postal Service. Although Export Administration Regulations 
grant Postal Service officials the authority to inspect items declared for export, 
the Postal Service is prohibited by law from opening mail that is sealed against 
inspection without a warrant, unless exigent circumstances exist (for example, 
where the screening of the mail has disclosed the presence of materials that pose a 
physical threat to persons or property). 

As a result, the Postal Service works with the Bureau of Customs and Border 
Protection (CBP) to coordinate enforcement activities concerning outbound mail 
and ensure compliance with export control laws and regulations. CBP personnel 
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are authorized to open and inspect mail and are co-located at postal facilities 
nationwide. 


Objective 


The main objective of the 2007 review was to determine whether management 
effectively addressed recommendations in previous reports required by the 
National Defense Authorization Act. 4 


Implementation of Recommendations for Controls Over 
Exports 


The interagency review identified agency-specific areas lacking adequate controls 
because prior recommendations were not implemented. However, this year’s 
interagency report contains no findings or recommendations. Therefore, 
management comments are not required. 

The participating OIGs made specific recommendations for their own agencies. 
Those recommendations, management comments, and OIG responses are 
included in the separate reports that each office issued. See Appendixes B 
through H, as well as J and K. 


4 The Department of Commerce OIG also conducted a separate review of U.S. dual-use export controls for 
India. 
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Appendix A. Scope and Methodology 


Interagency Scope 

This interagency review assessed the effectiveness of the U.S. Government’s 
export control policies and practices for preventing the unauthorized transfer of 
sensitive U.S. technology to countries and entities of concern. Specifically, we 
examined whether our prior recommendations—made from 2000 through 2006— 
were implemented by management to improve export control policies and 
procedures. 

From 2000 through 2006, 9 OIGs issued 49 reports and made 
271 recommendations to improve Federal export control policies and procedures. 
This report provides the status of Federal managers’ implementation of those 
recommendations. 

The participating review teams, from 2000 through 2006, represented the 
Inspectors General of the Departments of Agriculture, Commerce, Defense, 
Energy, Homeland Security, State, and the Treasury; the Central Intelligence 
Agency; and the United States Postal Service. 


Interagency Methodology 

The nine OIG teams* participated in an interagency working group and held 
monthly meetings while conducting agency-specific reviews. Those reviews 
focused on following up on recommendations made in previous OIG reports on 
controls over exports. 

This report summarizes the work completed by eight interagency OIG working 
group teams. The seven unclassified OIG reports are contained in Volume I, a 
For Official Use Only report is in Volume II, and a SECRET//NOFORN report 
and appendixes from the Central Intelligence Agency OIG and the Commerce 
OIG reports, respectively, are in Volume III. The interagency review was 
performed between June 2006 and July 2007. 


The Department of Agriculture OIG made two recommendations in March 2005. These 
recommendations were implemented by the Department of Agriculture. Therefore, it was not necessary 
that the Department of Agriculture OIG issue a followup report. 
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UNITED STATES DEPARTMENT OF COMMERCE 
The Inspector General 

Washington, D.C. 20230 


March 30, 2007 


MEMORANDUM FOR: Mark Foulon 

Acting Under Secretary for Industry and Security 


FROM: 

SUBJECT: 


As a follow-up to our February 23, 2007, d^arft report, attached is our final report on dual- 
use export controls for India, die eighth report required by the National Defense 
Authorization Act for Fiscal Year 2000, as amended. As you know, the act mandates that 
we issue a report to the Congress on the policies and procedures of the U.S. government 
with respect to the export of technologies and technical information to countries and 
entities of concern by March 30 of each year through 2007. 



While our review found that coordination between the various federal export licensing 
agencies was adequate during the dispute resolution process for export license 
applications involving India, we identified several areas of concern related to U.S.-lhdia 
export control activities. We offer a number of specific recommendations beginning on 
page 27 that we believe will help strengthen these activities, if implemented. This report 
contains three classified appendixes that have been provided under separate cover. 
Appendix D discusses implementation of the Next Steps in Strategic Partnership and is 
classified SECRET. Appendix E is classified CONFIDENTIAL and highlights concerns 
related to BIS’ end-use check program in India. Appendix F contains a summary of the 
classified recommendations and is classified SECRET. 


We are pleased to note that BIS, in its written response to our draft report, indicated that 
it plans to take action on many of our recommendations. We request that you provide us 
with an action plan addressing the status of the recommendations in our report within 60 
calendar days. 

We thank you and other members of the BIS staff for your assistance and courtesies 
extended to us during our review. If you would like to discuss this report or the requested 
action plan, please call me at (202) 482-4661 or Jill Gross, Assistant Inspector General 
for Inspections and Program Evaluations, at (202) 482-2754. 


Attachment 




U.S. Department of Commerce 
Office of Inspector General 


Final Report IPE-18144 
_ March 2007 
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SUMMARY 

The Inspectors General of the Departments of Commerce, Defense, Energy, and State, in 
consultation with the Director of Central Intelligence and the Director of the Federal Bureau of 
Investigation, are required by the National Defense Authorization Act (NDAA) for Fiscal Year 
2000 to conduct an 8-year assessment of whether export controls and counterintelligence 
measures are adequate for preventing the acquisition of sensitive U.S. technology and technical 
information by countries and entities of concern. The NDAA mandates that the Inspectors 
General report their findings to Congress no later than March 30 of each year, until 2007. 

To satisfy the NDAA’s FY 2007 reporting requirement, the Commerce Office of Inspector 
General assessed the effectiveness of BIS’ export control program for India in conjunction with a 
separate review to determine the status of prior-year recommendations involving dual-use 
licensing and enforcement activities. We examined (1) whether BIS’ export control policies, 
practices, and procedures for India are clear, documented, and designed to achieve the desired 
goals; (2) whether BIS personnel are following the prescribed policies, practices, and procedures 
relating to India; and (3) how effective BIS is in detecting and preventing the diversion of 
sensitive commodities to weapons of mass destruction-related programs (either within or outside 
India). 

Following the nuclear tests conducted by both India and Pakistan in May 1998, the United States 
imposed economic sanctions on both countries. However, in 2001, the President eliminated the 
sanctions and committed the United States to a “strategic partnership” with India—representing a 
major change in India-U.S. relations. At that time, both countries agreed to greatly expand 
cooperation on a wide range of issues, including counterterrorism, regional security, space and 
scientific collaboration, civilian nuclear safety, and broadened economic ties. Toward that end, 
BIS has played an active and key role in improving relations with India. Its most direct 
involvement began in 2002 with the establishment of the U.S.-India High Technology 
Cooperation Group (HTCG), designed to provide a forum for discussing high-technology issues 
of mutual interest and to broaden dialogue and cooperation in the area of export controls. 1 

As the world’s fastest growing free-market democracy, India presents lucrative and diverse 
opportunities for U.S. exporters along with unique challenges to U.S. export control policy. 

In 2005 the value of U.S. merchandise exports to India totaled almost $8 billion—up 30 percent 
from 2004 2 and nearly double the 2002 figure. 3 BIS reports that only about 1 percent of total 
U.S. exports to India require an export license, and the agency approves most exports that do 
require a license provided such items do not contribute to India’s nuclear, missile, or chemical 
and biological weapons programs. Although India is recognized as a democratic partner in the 
fight against terrorism and as a counterbalance to China, concerns have been raised by 
nonproliferation specialists about its nuclear capabilities and intentions. As current U.S. policy 
moves toward “full civil nuclear cooperation” with India, a critical question needs to be 


'Matthew Borman, Deputy Assistant Secretary for Export Administration, Overview of U.S.-India Dual-Use Export 
Policies and Procedures (presentation given to Indian industry in New Delhi on November 21,2003). 

2 U.S. Trade Representative, 2006, National Trade Estimate Report on Foreign Trade Barriers. Washington, D.C., 
page 300. 

department of Commerce, U.S. Commercial Service, November 29-December 5, 2006, Official Mission Statement. 



U.S. Department of Commerce 
Office of Inspector General 


Final Report IPE-18144 
_ March 2007 


answered: Does the U.S. government have the capability to implement effective export controls 
to help ensure U.S. exports to India do not contribute—either directly or indirectly—to Indian 
nuclear weapons or missile programs? 

The number of India export license applications received by BIS increased 30 percent from FY 
2002 to FY 2005, but decreased 19 percent from FY 2005 to FY 2006. This decline is 
attributable to a reduction in licensing requirements for exports to India. The most significant 
changes occurred in 2005, namely (1) elimination of export and reexport license requirements for 
most end users in India for items controlled unilaterally by the United States for nuclear 
nonproliferation reasons, (2) removal of the Indian Space Research Organization (ISRO) 
headquarters from BIS’ Entity List, 4 and (3) elimination of licensing requirements for exports of 
EAR99 items 5 to several ISRO subordinate entities. 

Our review of India export license applications that were escalated to the interagency dispute 
resolution process in fiscal years 2005 and 2006 found that coordination between the various 
federal export licensing agencies was adequate. However, our overall review of U.S.-India 
export control activities identified the following concerns that warrant management’s attention: 

Dual-Use Export Control Policies and Practices for India Are Not Fully Transparent. In 

January 2004, the United States and India announced the Next Steps in Strategic Partnership 
(NSSP)—an agreement to increase cooperation in civilian nuclear activities, civilian space 
programs, and high-technology trade, as well as to expand the U.S.-Indian dialogue on missile 
defense. The initiative was to proceed through a series of reciprocal steps that built on each 
other, addressing nuclear regulatory and safety issues and regulatory changes that would enhance 
trade in primarily high-technology dual-use goods. 6 As the various steps were determined by the 
U.S. government to be completed by India, a number of license requirements for exports to India 
were removed. On July 18, 2005, President Bush and Indian Prime Minister Dr. Manmohan 
Singh announced that the NSSP initiative had been completed and declared that they are 
committed to transforming the relationship between the United States and India and establishing 
a global partnership. 7 

When the NSSP was launched, BIS helped evaluate and implement the steps set forth in the 
initiative. However, questions remain among some U.S. government nonproliferation experts 
about whether the Government of India has fully implemented two of the export control-related 


4 The Entity List, established in February 1997 by BIS, identifies individuals, groups, organizations, and other 
entities whose activities offer the potential for diverting exported and reexported items into programs related to 
weapons of mass destruction. The EAR imposes additional export license requirements for transactions involving 
listed entities. 

5 EAR99 essentially serves as a “basket” designation for items that are subject to the Export Administration 
Regulations (EAR) but not listed on the Commerce Control List. EAR99 items can be shipped without a license to 
most destinations under most circumstances unless certain prohibitions apply (e.g., export to an embargoed 
destination). The majority of U.S. exports are EAR99 items. 

6 George W. Bush, January 12, 2004. President’s Statement on Strategic Partnership with India, 
http://www.whitehouse.gov/news/releases/2004/01/20040112-1 .html (accessed January 31, 2007). Alan K. 
Kronstadt, April 6, 2006. India-U.S. Relations, CRS Issue Brief for Congress, IB93097. 

1 Joint Statement Between President George W. Bush and Prime Minister Manmohan Singh, July 18, 2005 
(http://www.whitehouse.gov/news/releases/2005/07/2005Q718-6.html (accessed January 31, 2007). 
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steps outlined under the NSSP. We discuss this issue and our concerns in Appendix C, 
Implementation of Next Steps in Strategic Partnership, classified SECRET. 

We also found a problem with BIS’ Entity List—a list of entities worldwide for which the U.S. 
government requires a license for virtually all items subject to the EAR. Some Indian entities on 
the list are not clearly identified, which raises the risk that U.S. exporters could inadvertently 
export controlled dual-use items to these entities without the required license. The Entity List 
contains 12 Indian entities identified by name along with 3 “types” of Indian end users (e.g., 
nuclear reactors not operating under International Atomic Energy Agency safeguards. At least 2 
of 29 license applications were escalated to the interagency dispute resolution process in FY 
2005 because of questions about whether the Indian entity on the application was covered under 
one of these broad designations of end users (see page 13). 

BIS’ End-Use Check Program in India Needs to Be Improved. End-use checks seek to verify 
the legitimacy of dual-use export transactions controlled by BIS. A pre-license check (PLC) is 
used to validate information on export license applications by determining if an overseas person 
or firm is suitable for a transaction involving controlled U.S.-origin goods or technical data. 
Post-shipment verifications (PSVs) strengthen assurances that exporters, shippers, consignees, 
and end users are complying with the terms of export licenses, by determining whether goods 
exported from the United States were actually received by the party named on the license and are 
being used in accordance with license provisions. BIS has an export control officer (ECO) 
stationed in India to conduct end-use checks. 

Our review of BIS’ India end-use check program identified several weaknesses. First, the 
September 2004 End-Use Visit Arrangement between the U.S. Department of Commerce and the 
Indian Ministry of External Affairs-designed to strengthen existing commitments on export 
controls—actually limits the effectiveness and utility of end-use checks in India. In addition, 
while end-use checks involving Indian private sector entities are generally conducted in a timely 
manner, those involving Indian government or government-affiliated entities have not always 
been conducted within prescribed time frames. We also found that BIS has not set clear and 
consistent time frames for two parts of its internal end-use check process: (1) initiating PSVs 
upon receipt of required shipping documents and (2) notifying the Ministry of External Affairs 
about end-use check requests. 

Furthermore, we determined that BIS failed to follow its end-use check criteria for two PLCs that 
were cancelled but should have been rated as “unfavorable” because the government entity 
involved failed to cooperate in the checks. Finally, although the U.S. government is concerned 
about diversions of sensitive exports to programs involving weapons of mass destruction (either 
within or outside India), BIS did not adequately target PSVs to help determine whether 
diversions were occurring. We detail our concerns about these issues in Appendix E, End-Use 
Checks in India, classified CONFIDENTIAL. 

BIS Needs to Enhance Its Efforts to Ensure Compliance with License Conditions. Placing 
conditions on a license is the U.S government’s way of better controlling and monitoring certain 
shipments. However, license conditions only have the desired effect when exporters and/or end 
users fully comply with them. In general, BIS has put adequate procedures in place over the last 
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few years, in response to OIG recommendations, to help ensure compliance with license 
reporting conditions. 8 However, we found that Export Administration and Export Enforcement, 
both of which have responsibility for monitoring compliance with certain license conditions, 
need to improve their implementation of these procedures. 

Within Export Administration, we determined that some licensing officers did not fully adhere to 
BIS procedures for requiring exporters or end users to fulfill the license reporting conditions, that 
is, to submit documentation related to the shipment. For 5 of the 13 India licenses we identified 
as having reporting conditions, the licensing officer did not mark the licenses for follow-up. In 
addition, Export Administration issued a memorandum on May 9, 2006, requiring licensing 
officers to review technical documentation submitted pursuant to a license condition if the 
documentation was requested because of BIS national security concerns with the transaction. 
However, the memorandum specifically excludes those licenses involving reporting conditions 
placed on a license by the Defense Department unless BIS licensing officers also have a concern 
with the transaction. As a result, 10 of the 13 India licenses were not marked for licensing 
officer review because the technical reporting condition was placed by Defense. However, BIS 
has the authority to administer and enforce the EAR and, as such, is ultimately responsible for 
monitoring all conditions placed on a dual-use license. Furthermore, we determined that staff 
from the Office of Exporter Services (OExS) were not fully aware of the reporting conditions 
they were required to monitor, and they were not properly referring noncompliant exporters to 
Export Enforcement. This breakdown in Export Administration’s monitoring process might 
diminish the deterrent effect that license conditions can have on potential violators (see page 18). 

Within Export Enforcement, we found that the Office of Enforcement Analysis (OEA) is not 
fully adhering to its guidance for monitoring or enforcing compliance with licenses that contain 
condition 14, which requires exporters to notify OEA within 30 days that a shipment pertaining 
to a license has taken place. It is one of the most critical conditions placed on a license, because 
the interagency licensing agencies decided that a PSV was needed to determine whether the 
goods or technology were being used in accordance with the license provisions. But the PSV 
cannot be initiated until the shipment has actually taken place. Our review of 24 India licenses 
containing condition 14 determined that 11 exporters submitted their shipping documents to BIS 
between 12 to 1,158 days after the 30-day deadline. In fact, of the cases where a PSV was 
requested, 8 out of 24 PS Vs were initiated more than 100 days after shipment. This delay 
diminishes the possibility of detecting diversions or other violations of license terms and 
conditions. We also found that OEA (1) recommended approval for additional licenses to 
exporters that had previously not fully complied with the condition 14 reporting requirement, and 
(2) did not refer noncompliant exporters to the Office of Export Enforcement for appropriate 
action (see page 22). 

On page 27, we summarize the unclassified recommendations we are making to address our 
concerns. A summary of classified recommendations can be found in Appendix F, which is 
SECRET. 


8 U.S. Department of Commerce Office of Inspector General, June 1999. Improvements Are 
Needed to Meet the Export Licensing Requirements of the 21st Century, IPE-11488; Commerce OIG, March 2003. 
Improvements Are Needed to Better Enforce Dual-Use Export Control Laws, IPE-15155; Commerce OIG, March 
2006. U.S. Dual-Use Export Controls for China Need to be Strengthened, IPE-17500. 
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BIS Response to OIG Draft Report and OIG Comments 

In its March 23, 2007, written response to our draft report, BIS indicated that it was still in the 
process of reviewing some of the recommendations while taking steps to address others. The 
response also highlighted BIS’ belief that India has fulfilled its commitment under the Next 
Steps in Strategic Partnership. Where appropriate, we have made changes to the report in 
response to both formal and informal comments from BIS. We also discuss pertinent aspects of 
BIS’ response in appropriate sections of the report. The complete responses from BIS are 
included as appendixes to the unclassified and classified reports. 
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BACKGROUND 

The United States controls the export of dual-use items for national security, foreign policy, and 
nonproliferation reasons under the authority of several different laws. Dual-use items are 
commodities, software, and technologies that have predominantly civilian uses, but also can have 
military, proliferation, and terrorism-related applications. The primary legislative authority for 
controlling the export of dual-use commodities is the Export Administration Act of 1979, as 
amended, which is implemented through the Export Administration Regulations (EAR). 1 

The Department of Commerce’s Bureau of Industry and Security (BIS) administers the EAR by 
developing export control policies and regulations, issuing export licenses, and enforcing the 
laws and regulations for dual-use exports. In FY 2006, BIS had 353 full-time equivalent staff 
members and an appropriation of approximately $75 million. Its two operating units principally 
responsible for export controls are Export Administration and Export Enforcement. 

U.S.-India Relations and Dual-Use Export Control Concerns 

The U.S.-India relationship has undergone a significant 
transformation since the end of the Cold War. Both countries, 
“politically and economically distant” for almost half of the late 
20 th century, are now finding a common ground with respect to 
their national interests. 2 As the world's fastest growing free- 
market democracy, India presents lucrative and diverse 
opportunities for U.S. exporters. 3 In 2005, U.S. merchandise 
exports to India were almost $8 billion, 30 percent higher than in 
2004 and nearly double the 2002 figure. Corresponding U.S. imports from India were $18.8 
billion in 2005, up 20.8 percent from the previous year. 4 India is the 22 nd largest export market 
for U.S. goods, 5 and its requirements for equipment and services in the infrastructure, 
transportation, energy, environmental, health care, high-tech, and defense sectors are expected to 
exceed tens of billions of dollars in the coming years. 6 

U.S. Export Control Policies and Practices Toward India 

India presents unique challenges to U.S. export control policy. Although India is recognized as a 
democratic partner in the fight against terrorism and as a counterbalance to China, 
nonproliferation experts have raised concerns about India’s nuclear capabilities and intentions. 
Following the nuclear tests conducted by India and Pakistan in May 1998, the United States 


‘50 U.S.C app. sec. 2402(2). Although the act expired on August 20, 2001, Congress agreed to the President’s 
request to extend existing export regulations under Executive Order 13222, dated August 17, 2001, as extended by 
the Notice of August 3, 2006, 71 FR 44551 (August 7, 2006), thereby invoking emergency authority under the 
International Emergency Economic Powers Act. 

2 U.S. Department of Commerce, U.S. Commercial Service, November 29-December 5, 2006. Official Mission 
Statement: Under Secretarial Business Development Mission to India. Washington, DC. 

3 With more than one billion residents, India is the second most populous country and the largest democratic republic 
in the world. 

4 U.S. Trade Representative, 2006. National Trade Estimate Report on Foreign Trade Barriers. Washington, D.C., 
p. 300. Commerce, U.S. Commercial Service, November 29-December 5, 2006. Official Mission Statement. 

5 U.S. Trade Representative, 2006. National Trade Estimate Report on Foreign Trade Barriers, p. 300. 

6 Commerce, U.S. Commercial Service, November 29-December 5,2006. Official Mission Statement. 
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imposed economic sanctions on both countries. 7 At that time, the U.S. government implemented 
a licensing policy of denial for exports and reexports of items controlled for nuclear 
nonproliferation and missile technology reasons to India (and Pakistan), with limited exceptions. 

In September 2001, President George W. Bush waived the sanctions against India (and Pakistan) 
and, subsequently, the policy of denial for exports and reexports of items controlled for nuclear 
nonproliferation and missile technology reasons changed to a case-by-case review. Then, in 
November 2001, President Bush and then-Indian Prime Minister Atal Bihari Vajpayee 
committed the United States and India to a strategic partnership, that among other things 
envisioned full civil nuclear cooperation between the United States and India and reversed 
almost 30 years of U.S. nonproliferation policy toward that country. Both countries also agreed 
to greatly expand cooperation on counterterrorism, regional security, space and scientific 
collaboration, and broadened economic ties. Since that time, two initiatives regarding relations 
between the United States and India have received wide public attention. The first was what has 
become known as the Next Steps in Strategic Partnership (NSSP), announced in January 2004. 
Under the NSSP, the United States and India agreed to increase cooperation in civilian nuclear 
activities, civilian space programs, and high-technology trade, and expand their dialogue on 
missile defense. The initiative was to proceed through a series of reciprocal steps that built on 
each other. They included nuclear safety issues and regulatory changes that would enhance trade 
in high-technology dual-use goods. 8 

The second major announcement—coinciding with the reported completion of the NSSP—came 
on July 18, 2005, when President Bush and Prime Minister Manmohan Singh jointly declared 
that they were committed to transforming the relationship between the United States and India 
and establishing a “global partnership.” Their statement highlighted five broad areas of 
agreement and cooperation: economic development; energy and the environment; democracy 
and development; nonproliferation and security; and high-technology and space. In his speech, 
the President recognized India’s “strong commitment” to preventing the proliferation of weapons 
of mass destruction and noted that “as a responsible state with advanced nuclear technology, 
India should acquire the same benefits and advantages as other such states.” The President 
added that he would “.. .work to achieve full civil nuclear energy cooperation with India as it 
realizes its goals of promoting nuclear power and achieving energy security.” However, the 
President also acknowledged that this would require adjustment to U.S. law (e.g., the Atomic 
Energy Act of 1954, as amended), 9 10 and policy as well as international export control regimes 
(e.g., Nuclear Suppliers Group, which controls items or technologies that could be used in 
nuclear weapons). 


7 The sanctions were imposed pursuant to Section 102 (b)(2) of the Arms Export Control Act, also known as the 
Glenn Amendment of 1994. The Act requires that the President impose sanctions against a "non-nuclear-weapon" 
state if it "detonates a nuclear explosive device." 

8 George W. Bush. President’s Statement on Strategic Partnership with India, January 12, 2004, 
http://www.whitehouse.gov/news/releases/2004/01/20Q40112-1 .html (accessed January 31, 2007); Kronstadt, Alan 
K. India-U.S. Relations, CRS Issue Brief for Congress, April 6, 2006, IB93097. 

9 42 U.S.C. 2153. The Atomic Energy Act prohibits the transfer of nuclear materials and technology to countries that 
are not signatories to the Treaty on the Non-Proliferation of Nuclear Weapons. 

10 'Joint Statement Between President George W. Bush and Prime Minister Manmohan Singh, July 18, 2005 
(http://www.whitehouse.gov/news/releases/2005/07/2005Q718-6.html (accessed January 31, 2007). 
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Toward this end, the U.S. Congress passed and the President signed the United States-India 
Peaceful Atomic Energy Cooperation Act of 2006 on December 18, 2006. The act enables the 
United States to enter into an agreement for nuclear cooperation with India if the President 
makes a determination that various actions have occurred. 11 For instance, the President must 
find that India has provided the United States and the International Atomic Energy Agency with 
a credible plan to separate civil and military nuclear facilities, materials, and programs, and has 
filed a declaration regarding its civil facilities and materials with the International Atomic 
Energy Agency. The President must also find that India is taking the necessary steps to secure 
nuclear and other sensitive materials and technology, including: 

• Enactment and effective enforcement of comprehensive export control legislation and 
regulations; 

• Harmonization of its export control laws, regulations, policies, and practices with the 
guidelines and practices of the Missile Technology Control Regime and the Nuclear 
Suppliers Group; and 

• Adherence to the Missile Technology Control Regime and the Nuclear Suppliers Group 
(NSG) in accordance with the procedures of those regimes for unilateral adherence. 

Finally, the act requires the President to determine that the NSG has decided by consensus to 
permit supply to India of nuclear items covered by the guidelines of the NSG. 

BIS’ Role in U.S. Export Control Policies and Practices Toward India 

BIS has played an active role in improving relations with India. Its direct involvement began in 
2002 with the establishment of the U.S.-India High Technology Cooperation Group (HTCG) by 
then Under Secretary Kenneth I. Juster and India’s former Foreign Secretary Kanwal Sibal. The 
HTCG was designed to provide a forum for discussing high-technology issues of mutual interest, 
and broaden dialogue and cooperation in the area of export controls. 12 When the NSSP was 
launched, BIS participated in evaluating and implementing the steps set forth in the initiative 
while continuing its leading role in facilitating high-technology trade cooperation between the 
United States and India. [See chapter I and appendix C (classified SECRET) for a detailed 
discussion of the NSSP.] 

According to BIS, as a result of the HTCG work and in conjunction with the NSSP, the U.S. 
government eliminated approximately 25 percent of the licensing requirements for exports to 
India by removing some Indian entities from the Entity List 13 and dropping most unilateral 
export controls. As a result, U.S. firms can export many formerly controlled items to India 


"These actions were specified in Section 104 (b) of the Henry J. Hyde United States-India Peaceful Atomic Energy 
Act of 2006, December 18, 2006. 

12 BIS, November 21, 2003. Overview ofU.S.-India Dual-Use Export Policies and Procedures, Presentation by 
Matthew Borman, Deputy Assistant Secretary for Export Administration. 

13 The EAR contains an Entity List that imposes increased export license requirements for transactions involving 
certain “listed” entities (e.g. companies, organizations, persons). The Entity List was established in February 1997 
to inform the public of entities whose certain activities impose a risk of diverting exported and reexported items into 
programs related to weapons of mass destruction. The list may also include entities sanctioned by the State 
Department for which United States foreign policy goals are served by imposing additional license requirements on 
exports and reexports to those entities. The list contains entities from a variety of countries including China, India, 
Israel, and Pakistan. See chapter I for a discussion about Indian entities on the list. 
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without a license or under a license exception. 14 BIS reports that approximately 1 percent of 
total U.S. exports to India require an export license and that it approves most of the exports of 
controlled items provided that such items would not be used in unsafeguarded nuclear activities, 
ballistic missiles, or space launch vehicle programs or otherwise be diverted to uses contrary to 
U.S. policy. 

The United States currently controls dual-use exports to India that have potential applications for 
chemical and biological, nuclear weapons, or missile technology, or that can impact regional 
stability, national security, and crime control. These controls are primarily derived from 
multilateral export control regimes, and the list of items controlled is mutually agreed upon by 
participating countries. There are no U.S. sanctions currently in place against the Indian 
government, although several Indian entities have U.S. sanctions placed on them for 
proliferations reasons. 

Dual-Use License Application Process for Exports to India 

License applications received by BIS are entered into the Export Control Automated Support 
System (ECASS), 15 where they are screened to determine whether the listed parties have 
registration numbers or need numbers assigned. ECASS flags applications that require referral 
to the Office of Export Enforcement (OEE), and sends them simultaneously to OEE and 
licensing officers in Export Administration. All other applications are referred only to the 
licensing officers for processing. 

According to Executive Order 12981, 16 BIS has 9 days to conduct its initial review of a license 
application, during which the licensing officer first verifies the export control classification 
number (ECCN) the applicant obtained from the Commerce Control List (CCL)—a listing of 
commodities, software, and technology subject to BIS’ export licensing authority. Items subject 
to the EAR but not listed on the CCL are designated as “EAR99." 17 

After verifying the ECCN, the licensing officer reviews the related license requirements and 
exceptions, determines the reasonableness of the end use specified by the exporter, and 
documents the (1) licensing history of the exporter and ultimate consignee or end users, and (2) 
reasons for not referring an application to the other licensing agencies (if applicable). The 
licensing officer provides a written recommendation on whether to approve or deny the 
application, and refers it to the Departments of Defense, Energy, and State unless those licensing 
referral agencies have delegated their decision-making authority to Commerce. 18 


l4 According to the BIS, a license exception is an authorization granted by BIS that allows exports or reexports of 
items subject to the EAR that would otherwise require a license. 

15 ECASS is an unclassified system that BIS uses to process and store its dual-use export licensing information. 

16 Administration of Export Controls, December 5, 1995. 

17 EAR99 essentially serves as a “basket” designation for items that are subject to the EAR but not specifically listed 
on the CCL by an ECCN. EAR99 items can be shipped without a license to most destinations under most 
circumstances unless certain prohibitions apply (e.g., export to an embargoed destination). The majority of U.S. 
exports are EAR99 items. 

I8 BIS refers licenses to the Department of Justice only when the item is controlled for reasons relating to the 
protection of encryption technologies. As such, per Executive Order 13026, the Department of Justice is a voting 
representative at all levels of the dispute resolution process for encryption cases (including the Operating 
Committee, the Advisory Committee on Export Policy, and the Export Administration Review Board). 
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In addition, BIS requires that its licensing officers forward all India export license applications 
(with the exception of deemed export license applications and EAR99 items without red flags) 19 
to the CIA’s Weapons Intelligence, Nonproliferation, and Arms Control Center for an end-user 
review. 

Under Executive Order 12981, each licensing referral agency must provide a recommendation to 
approve or deny the license application and all related required information to the Secretary of 
Commerce within 30 days of receiving the referral. To deny an application, a referral agency or 
BIS is required to cite both the statutory and regulatory basis for denial, consistent with the 
provisions of the EAA and the EAR. An agency that fails to provide a recommendation within 30 
days is deemed to agree with the decision of the Secretary of Commerce (see appendix B for a 
flow chart depicting the licensing process). 

In FY 2006, all export licenses for India were issued with conditions that subjected the exporter 
to certain restrictions. The conditions are primarily used to control proliferation of the 
commodity by limiting the end-use or restricting access to the commodity to specific end users 
(see chapter III for more discussion on license conditions). 

Dispute Resolution Process for India Export License Applications 

If there is disagreement on whether to approve a pending license application after the 30-day 
review period or if there is disagreement on the conditions of approval, the application is referred 
to a higher-level interagency working group called the Operating Committee (OC), which meets 

weekly (see figure 1 for the number of 
India export license applications 
escalated to the OC in FYs 2005 and 
2006). Under Executive Order 12981, the 
OC has voting representatives from the 
Departments of Commerce, Defense, 
Energy, and State. Nonvoting members 
of the OC include appropriate 
representatives of the CIA and the Joint 
Chiefs of Staff. The Secretary of 
Commerce appoints the OC chairman, 
who considers the recommendations of 
the referral agencies before making a 
decision. With one exception, the 
chairman’s decision does not have to 
follow the recommendations 
of the majority of the participating 
agencies, though we found that the 
chair’s decisions for India cases generally 


Figure 1: Determinations for India Export 
License Applications Escalated to the 
Operating Committee (FY2005 and 2006) 



Approved Denied Returned 
| ■ FY2005 II FY2006] Without Action 


Source: BIS 


19 Red flags indicate possible violators or violations of the EAR. 
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did reflect interagency consensus. 20 If any of the voting agencies disagree with the OC decision, 
they have 5 days to appeal. 

Appeals at the OC level escalate the decision to the Advisory Committee on Export Policy 
(ACEP). The ACEP meets monthly if there are applications to decide. It is chaired by the 
Commerce Assistant Secretary for Export Administration and consists of Assistant Secretary- 
level voting representatives from the Departments of Defense, Energy, and State. Nonvoting 
representatives are drawn from the CIA and the Joint Chiefs of Staff. The ACEP’s decision is 
based on a majority vote. In FY 2005, one India export license was escalated to the ACEP; it 
was ultimately approved with conditions. Two India export license applications were escalated 
to the ACEP in FY 2006, and both were approved with conditions. 

An agency that disagrees with an ACEP decision has 5 days to appeal to the Export 
Administration Review Board (EARB). The Secretary of Commerce chairs the EARB, whose 
voting members also include the Secretaries of Defense, Energy, and State. The chairman of the 
Joint Chiefs of Staff and the director of Central Intelligence are nonvoting members. The 
EARB’s decision is based on a majority vote and a dissenting agency has 5 days to make a final 
appeal to the President. No export license application for India was escalated to the review 
board in either FY 2005 or FY 2006. 

Overall, we found that the interagency escalation process for disputed India export license 
applications allows dissenting agencies a meaningful opportunity to seek additional review of 
such cases. 

India Export License Application Trends 

During FYs 2002 through 2004, the number of dual-use export license applications received for 
India increased approximately 56 percent from 784 to 1,226. However by FY 2006, this number 
dropped by approximately 30 percent (see figure 2). Of the 18,698 export license applications 
BIS received during FY 2006, 827 (approximately 4.4 percent) were for exports to India. A 
reduction in the number of dual-use export license applications for India is attributable to fewer 
license requirements, as a result of the NSSP and the ongoing work of the HTCG. 


20 Executive Order 12981, as amended, provides one exception to this rule for “ .. . license applications concerning 
commercial communication satellites and hot-section technologies for the development, production, and overhaul of 
commercial aircraft engines ...” For these applications, the OC chair is to report the “majority vote decision of the 
OC” rather than his/her decision. 
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Figure 2: Export License Applications BIS Received for India 



Source: BIS 


Based on the number of export license applications BIS processed for India during FY 2006, 587 
were approved, 39 were denied, and 189 were returned without action (see figure 3 for a 
breakdown of BIS’ determinations for these licenses). 

Figure 3: India Export License Applications Processed by BIS 
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Trends in Technologies Sought bv India Through the Export Licensing Process 


Most of the export license applications for India in FY 2006 involved technologies categorized 
under materials, chemicals, “microorganisms,” and toxins; materials processing; 
telecommunications and information security; and computers (see table 1 for a full listing of the 
number of export license applications BIS received for each CCL category). 


Table 1: BIS License Applications for India by CCL Category (in FY 2006) 


0 Nuclear Materials, Facilities, and Equipment 8 

1 Materials, Chemicals, “Microorganisms,” and Toxins _ 225 

2 Materials Processing 208 

3 Electronics _ _ 95 

4 Computers 130 

5 Telecommunications and Information Security _ 206 

6 Lasers and Sensors _ _ 22 

7 Navigation and Avionics 56 

8 Marine _ _ 2 

9 Propulsion Systems, Space Vehicles, and Related Equipment 55 

EAR99 Classification used for items subject to the EAR but not listed on the CCL _ 147 

*Note: Because applications may contain a request to export more than one technology, the number of 
applications in this column does not equal the total number of India export applications BIS received during FY 


Source: BIS 

End-Use Checks in India 

End-use checks play an important part in the export licensing process by helping BIS determine 
whether the end users or intermediary consignees are suitable recipients of sensitive U.S. items 
and technology and would likely comply with applicable license conditions. End-use checks 
include either pre-license checks (PLCs) or post-shipment verifications (PSYs) and may be 
requested by any of the executive agencies involved in the interagency licensing process. A PLC 
is conducted to establish the bona fides —or evidence of the qualifications—of a foreign entity 
involved in the export transaction while the license application is being reviewed. A PSV is 
conducted on a foreign entity after the license has been approved and the item shipped to help 
determine whether the licensed item is being used in accordance with license conditions. 

The U.S. Department of Commerce and the Indian Ministry of External Affairs entered into an 
End-Use Visit Arrangement in September 2004. Since November 2004, end-use checks in India 
have been conducted by an export control officer (ECO) based in New Delhi. ECOs are BIS 
export enforcement agents who hold the rank of commercial officer in the commercial section of 
U.S. embassies and consulates. 21 In addition to conducting end-use checks, they handle various 
other in-country export control activities. 

21 BIS has additional ECOs stationed in Abu Dhabi, United Arab Emirates; Moscow, Russia; Beijing, China; and 
Hong Kong. 
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Figure 4 depicts the number of end-use checks completed in India in FYs 2005 and 2006. In FY 
2006, the ECO only conducted those end-use checks requested by headquarters, which explains 
the drop in the number of checks 22 (see Chapter II for more discussion on the targeting of end- 
use checks). 


Figure^^LCsandPSVsComgletedjnlndiaFYslOOS-^OO^ 



FY2005 FY2006 


■ PLCs 0PSVs 


Source: BIS 


22 It should be noted that 34 of the 47 PSVs conducted in FY 2005 were actually identified by the ECO in the spring 
of 2004, prior to his appointment, in conjunction with an upcoming Sentinel trip he was to lead. A Sentinel trip is 
performed by domestic BIS export enforcement agents, largely to conduct PSVs. Often, Sentinel teams target some 
checks that are not requested by licensing officers or other U.S. government officials. Usually, the Sentinel checks 
involve conducting multiple PSVs at the same entity (so the team—and in this case the ECO in New Delhi—can 
group multiple checks at the same location), whereas headquarters-initiated checks usually involve conducting only 
one check at one entity. Therefore, in addition to conducting the end-use checks that were requested by BIS 
headquarters in FY 2005, the ECO conducted the 34 pending Sentinel checks. 
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OBJECTIVES, SCOPE, AND METHODOLOGY 

The Inspectors General of the Departments of Commerce, Defense, Energy, and State, in 
consultation with the director of Central Intelligence and the director of the Federal Bureau of 
Investigation, are required by the National Defense Authorization Act (NDAA) for Fiscal Year 
2000 to conduct eight annual assessments through FY 2007 of the adequacy of current export 
controls and counterintelligence measures in protecting against the acquisition of sensitive U.S. 
technology and technical information by countries and entities of concern. This is the eighth and 
final review under the NDAA requirement. 

To satisfy the NDAA’s FY 2007 reporting requirement, the Commerce Office of Inspector 
General assessed the effectiveness of BIS’ export control program for India in conjunction with a 
review to determine the status of prior-year recommendations involving dual-use licensing and 
enforcement activities. 23 We examined (1) whether BIS’ export control policies, practices, and 
procedures for India are clear, documented, and designed to achieve the desired goals; (2) 
whether BIS personnel are following the prescribed policies, practices, and procedures relating to 
India; and (3) how effective BIS is in detecting and preventing the diversion of sensitive 
commodities to weapons of mass destruction-related programs (either within or outside India). 

We conducted our evaluation from June through November 2006 under the authority of the 
Inspector General Act of 1978, as amended, and in accordance with the Quality Standards for 
Inspections issued by the President’s Council on Integrity and Efficiency in 2005. At the end of 
our review, we discussed our findings and conclusions with the Acting Under Secretary for 
Industry and Security and other senior BIS officials. 

Our methodology included the following activities: 

U.S. Interviews. Within BIS, we spoke with the Acting Under Secretary, Deputy Assistant 
Secretary for Export Administration, and the Assistant Secretary and Deputy Assistant Secretary 
for Export Enforcement. Within Export Administration, we met with the director of the Office 
of Exporter Services (OExS), the directors of the Offices of Nonproliferation and Treaty 
Compliance and National Security and Technology Transfer Controls, as well as with staff from 
each office. Within Export Enforcement, we met with the director and staff of the Office of 
Export Enforcement (OEE) and the Office of Enforcement Analysis (OEA). We also spoke with 
staff from OEE’s Boston field office regarding closed investigations involving Indian entities. In 
addition, we met with the chairperson of the Operating Committee, the policy advisor to the 
Assistant Secretary for Export Administration, the Export Administration Intelligence Liaison, 
and staff from BIS’ Office of Chief Counsel. 

We spoke with officials from federal agencies directly involved with or knowledgeable about U.S. 
dual-use export control policies and procedures related to India. Within the CIA, we spoke with 
analysts from the Center for Weapons Intelligence, Nonproliferation, and Arms Control. Within 
the Department of Defense, we spoke with officials from the Defense Technology Security 
Administration. Within the State Department, we interviewed staff from the Bureaus of South and 
Central Asia; International Security and Nonproliferation; and Political-Military Affairs, and 


23 A separate report on the status of all open recommendations resulting from Commerce OIG’s NDAA reporting 
will be issued in March 2007. 
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attended meetings of the Missile Technology Export Control Group and Subgroup on Nuclear 
Export Coordination. Within the Department of Energy, we met with officials from the Office of 
International Regimes and Agreements. 

Overseas Visit. We also traveled to India to assess U.S. dual-use export control operations. At 
the post, we interviewed officials at the U.S. embassy in New Delhi. We met with BIS’ ECO 
and accompanied him on two end-use visits to Indian entities located in Chennai and Bangalore 
(a representative from India’s Ministry of External Affairs was also present at the end-use visit in 
Chennai). 

We also spoke with the Commercial Service’s (CS) deputy senior commercial officer in India 
and the two commercial specialists who currently assist the ECO. In addition, we spoke with the 

embassy’s deputy chief of mission and the 
heads of the consular; defense; economic; 
environment, science, technology, and health; 
and political sections; and other relevant U.S. 
government officials. 24 Finally, we met with 
Government of India officials from the Defence 
Research and Development Organization and 
the Indian Space Research Organization to 
discuss the progress of end-use visits in India 
and obtain the Indian government’s views on 
some aspects of U.S. dual-use export controls. 

While in India, we also met with representatives 
from two leading Indian industry associations— 
the Confederation of Indian Industry and the 
Federation of Indian Chambers of Commerce— 
to discuss U.S. export controls and their efforts 
to promote U.S. and India export control 
compliance among Indian companies. 

Source:https://www.cia.gov/cia/publications/factbook/ 

geos/in.html 



Review of export control laws and regulations, relevant BIS guidance, and other 
documents. We examined current and prior legislation, executive orders, policy papers, and 
related regulations (including the EAR) that pertained to India. In addition, we reviewed the 
following documents, covering the period of FYs 2005 and 2006 (unless otherwise indicated): 

• Complete licensing histories for 43 India cases escalated to the OC and ACEP 

• Records for 106 India end-use checks (including applicable licensing histories) that were 
initiated or completed (for FY 2005 we only reviewed those checks that received ratings 
other than favorable) 

• Sentinel trip reports from July 2000 to December 2003 

• Program material related to the roles and responsibilities of the ECO in India 


24 During our visit we were unable to meet with Homeland Security’s Immigration and Customs Enforcement attache 
because the position was vacant. 
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• ECO’s subject matter files at post relating to export controls 

• Summaries of 124 India technology licenses for FYs 2005-2006 (through April 30, 2006) 

• BIS directives and procedures related to license monitoring 

• Relevant cable traffic and intelligence reports pertaining to India 


12 
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OBSERVATIONS AND CONCLUSIONS 

I. Dual-use Export Control Policies and Practices for India Are Not Fully Transparent 

The 2001 commitment by the United States and India to form a “strategic partnership” 
envisioned, among other things, full civil nuclear cooperation between the two countries and 
reversed almost 30 years of U.S. nonproliferation policy towards India. When the NSSP was 
launched in January 2004, BIS participated in evaluating and implementing the export control- 
related steps set forth in the initiative. As a result of the NSSP and in conjunction with the U.S- 
India High Technology Cooperation Group (which is co-chaired by BIS), the U.S. government 
eliminated approximately 25 percent of the licensing requirements for exports to India by 
removing some Indian entities from the Entity List and dropping most unilateral export controls. 
Thus, U.S. firms can export many items that formerly required a license to India without a 
license or under a license exception. Although the United States and India announced in July 
2005 that the objectives of the NSSP had been completed, questions remain over whether the 
Government of India has fully implemented two of the export control-related steps outlined 
under the agreement. 

We also found a problem with the listing of Indian entities found on BIS’ Entity List. 

Specifically, some Indian entities meant to be captured on the list are not clearly identified. As a 
result, U.S. exporters could inadvertently export dual-use controlled items to these entities 
without the required license. 25 

A. Questions remain over whether the Government of India has fully implemented two of 
the export control-related steps under the “Next Steps In Strategic Partnership” 

Due to the classified nature of the material discussed in this section, we offer our specific 
findings and recommendations in Appendix D, which is classified at the SECRET level. 

--—-- 

BIS Response to OIG Draft Report and OIG Comments 

In its written response to our draft report, BIS stated that it believes that India has fulfilled its 
commitments under the NSSP. BIS’ specific comments and our response are provided in the 
classified section of this report. 

B. BIS’ Entity List does not clearly identify some Indian entities 

BIS established the Entity List, a supplement to the EAR’s export license requirements, in 
February 1997 to inform the public of entities whose activities impose a risk of diversion of 
exported and reexported items into programs related to weapons of mass destruction (WMD). In 
conjunction with the 1998 economic sanctions against India for its nuclear tests, BIS increased 


25 A license is required for the export or re-export of all items subject to the EAR for most of the Indian entities on 
the Entity List. In addition, the nuclear end-use/end-user control in Section 744.2 of the EAR imposes a license 
requirement on all exports to three activities, one of which is “unsafeguarded” nuclear activities. This license 
requirement exists independent of the license requirements imposed by the Entity List. 
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the number of Indian entities on the list from 4 to more than 200. According to BIS, these 
additional entities were “determined to be involved in nuclear or missile activities.” 

In March 2000, BIS removed 51 Indian entities from the list after conducting a congressionally- 
mandated review intended to focus the list on entities that made direct and material contributions 
to WMD and missile programs. After removing the 51 entities, BIS restructured the list, 
moving many subordinate organizations affiliated with the listed Indian entities and of interest to 
the United States to a special appendix to the Entity List. The appendix included over 100 Indian 
subordinate entities associated with 6 different Government of India agencies. 

After the President waived the economic sanctions against India in 2001, BIS removed some 
Indian entities from the list and deleted the special appendix, reducing the number of named 
Indian entities on the Entity List at that time to 15. 26 As part of this action, BIS grouped 
subordinate entities of the Indian Department of Atomic Energy into three types or categories 
without listing the specific entities by name. The types are as follows: 

• Nuclear reactors (including power plants) not under the International Atomic 
Energy Agency safeguards (excluding Kundankulam 1 and 2), 27 

• Fuel reprocessing and enrichment facilities, and 

• Heavy water production facilities and their collocated ammonia plants. 

According to representatives of the agencies involved in the interagency licensing process, 
consolidating these subordinate entities into the three categories without naming them has made 
it more difficult to determine whether a specific entity is covered by the list. As a result, U.S. 
exporters could inadvertently export certain sensitive or EAR99 items to these entities without 
the required license. 

We identified two export license applications that were escalated to the Operating Committee, in 
part, because of disputes among interagency licensing officials as to whether the Indian entities 
on the applications were covered by the Entity List. Both cases involved subordinates of the 
Indian Department of Atomic Energy, but the licensing officials could not agree as to whether 
the entities were “safeguarded” or “unsafeguarded” nuclear facilities^—a key factor in 
determining whether the entities are subject to the list. 

It should be noted that in one of the two cases, part of the confusion was based on erroneous 
in f ormation provided by the applicant, who reported on the license application that the ultimate 
consignee was a subordinate of a listed entity. When the applicant realized that the ultimate 
consignee was not a subordinate of that entity, he asked BIS to modify the license application 
accordingly. At this point, according to the OC records, the then-acting OC Chair “suggested 
that the application be returned without action because the items listed were EAR99 and were 
destined to a non-listed entity.” However, while the ultimate consignee was not a subordinate of 
a listed entity, the Energy representative at the OC reported that it was a subordinate of the 


26 Since that time, an additional 3 Indian entities were removed from the list, making the total now 12. 

27 According to the International Atomic Energy Agency, safeguards are applied to verify a state’s compliance with 
its agreement to accept safeguards on all nuclear material in all its peaceful nuclear activities and to verify that such 
material is not diverted to nuclear weapons or other nuclear explosive devices. 
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Indian Department of Atomic Energy and as such, was still covered by the Entity List. State 
concurred with this assessment. 

Ultimately, it was determined that the ultimate consignees in both cases were “unsafeguarded” 
facilities and, as a result, were included on the list. Both license applications were subsequently 
rejected. However, these cases call into question how clear the Entity List actually is with regard 
to the Indian Department of Atomic Energy subordinates since it led to some confusion during 
the interagency licensing review process. 

The OC chair acknowledged that consolidating the list has created some confusion both for 
exporters and interagency licensing officials, resulting in an occasional dispute about whether a 
particular entity was listed. As a result, he prepared a handbook for OC members in early 2006 
that includes a section on Indian entries on the Entity List. The section compiles all the Federal 
Register notices relating to the addition and deletion of Indian entities on the list, as well as any 
licensing policy changes for specific entities since 1998. The chair believes this guidance has 
eliminated much of the confusion over which subordinate entities are covered by the list. 

The OC chair also provided this guidance to BIS licensing officers who attended an OC training 
session in June 2006. The positive feedback he received on the guidance prompted him to put it 
on BIS’ shared network in October 2006 so that all BIS’ licensing officers could have access to 
it. This document is not available to the public. Thus, while BIS and other U.S. licensing 
officials now have clearer information on the specific Indian entities on the Entity List, U.S. 
exporters do not. BIS needs to ensure that U.S. exporters clearly understand which Indian 
entities are meant to be captured on the Entity List to help ensure export controlled dual-use 
items are not inadvertently shipped to these entities without the required license. 

Recommendation : 

We recommend that BIS specifically list all of the Indian entities that should be captured on the 
Entity List, or determine an alternative means to better ensure exporter compliance with export 
license requirements. 


— - - - - — 

BIS Response to OIG Draft Report and OIG Comments 

In its written response to our draft report, BIS stated that it will review the listing of the Indian 
entities on the Entity List to determine how additional information can be provided to exporters. 
The planned completion date for this review is April 30, 2007. We acknowledge BIS’ planned 
efforts in this area and look forward to receiving a copy of the review results upon completion. 
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II. BIS’ End-Use Check Program in India Needs to Be Improved 

Given India’s importance in U.S. export control matters, BIS assigned one of its export 
enforcement agents to New Delhi in November 2004 to conduct end-use checks. This move has 
provided BIS with new opportunities to work more closely with the Government of India on 
export control matters. However, we identified several weaknesses in BIS’ end-use check 
program for India that should be addressed: 

• The End-Use Visit Arrangement 28 between the U.S. Department of Commerce and 
India’s Ministry of External Affairs limits the effectiveness of end-use checks. 

• While end-use checks involving Indian private sector entities are generally conducted in a 
timely manner, the majority of those involving government or government-affiliated 
entities are not. 

• BIS has not set clear and consistent time frames for completing two steps of the end-use 
check process, namely (1) initiation of PS Vs upon receipt of required shipping 
documents and (2) notification to the Ministry of External Affairs of end-use check 
requests. 

• Two of the India PLCs BIS cancelled in FY 2006 should have been rated “unfavorable” 
per the bureau’s end-use check criteria. 

• Although the U.S. government is concerned about diversions of sensitive exports to 
programs involving weapons of mass destruction, BIS did not adequately target PSVs to 
determine whether diversions were occurring. 

Because of the sensitive nature of these findings, we discuss them in Appendix E, classified 

at the CONFIDENTIAL level. 


—- - - - — -- 

BIS Response to OIG Draft Report and OIG Comments 

In its written response to our draft report, BIS stated that it disagreed with some of the report 
findings listed above. However, it agreed to take action to implement a number of the 
reco m mendations we proposed. BIS’ specific comments and our response are provided in the 
classified Appendix E to this report. 


28 Commerce and India’s Ministry of External Affairs entered into this agreement in September 2004 to establish 
procedures for full and timely end-use checks. 
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III. BIS Needs to Enhance Its Efforts to Ensure Compliance with License Conditions 

The EAR allows BIS or licensing referral agencies to place conditions on an export license when 
there are specific concerns about the exporter, end use, or end user. Frequently, the conditions 
are the result of lengthy negotiations among the licensing referral agencies. They are an 
important part of the interagency export licensing process and offer BIS an additional means for 
monitoring certain shipments. BIS monitors export licenses to ensure the holders comply with 
all license conditions. This endeavor requires the combined efforts of Export Administration and 
Export Enforcement. 

There are 55 standard license conditions. Six of these place reporting conditions on exporters or 
end users which require them to submit documentation to BIS regarding the shipment (see table 
2). 29 A seventh condition—referred to as “Write Your Own”—allows licensing officers to 
formulate unique requirements, which may include reporting requirements for either the exporter 
or the end user. Licenses with reporting conditions are tracked in the Follow-up Subsystem 
within ECASS. 


Table 2: License Conditions with Reporting Requirements* 


Condition 

BIS 

Responsible 

Unit 

Requirements 

10-Temporary 

Demonstration 

Export 

Administration 

Notify BIS once the licensed item is returned to 
the United States after its temporary demonstration 
in another country. 

12-Delivery 

Verification 

Standard 

Export 

Administration 

Provide BIS delivery verification documents. 

13-Delivery 

Verification 

Triangular 

Export 

Administration 

14-Post-Shipment 
Verification 
(PSV) 

Export 

Enforcement 

Submit a shipper’s export declaration to BIS 
following the shipment of the item (so that a PSV 
can be initiated). 

17-Aircraft on 

Temporary Sojourn 

Export 

Administration 

Notify BIS after the return of an aircraft on 
temporary sojourn to a foreign country. 

*The table excludes the “Write Your Own” condition (since there is no standard requirement to be followed) as 
well as the “NDAA PSV” condition (see footnote 30 below). 


Source: BIS and OIG 


29 The NDAA for FY 1998 requires BIS to perform PSVs on all high-performance computers with a computing 
capability beyond a certain threshold that are exported or reexported to “Tier 3” countries, including China, India, 
United Arab Emirates, and Israel. BIS implements this provision through condition 34 which requires exporters to 
submit a post-shipment report to BIS on exports of high-performance computers to “tier 3” countries. The act also 
requires BIS to submit annual reports to the Congress listing these high-performance computer exports and the 
results of the PSVs. License condition 34 is tracked separately from the ECASS Follow-up Subsystem. 
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The OIG previously reported that Export Administration and Export Enforcement did not 
consistently monitor licenses with reporting conditions and, therefore, did not ensure exporter or 
end user compliance with license conditions. 30 In response to our recommendations, both units 
instituted procedures to (1) regularly monitor licenses with reporting conditions that are marked 
for follow-up by licensing officers, (2) follow up with exporters to request any necessary 
reporting documentation, and (3) provide for the review of technical documentation submitted by 
exporters and end users. However, our review found that both Export Administration and Export 
Enforcement need to improve implementation of the procedures. 

A. Export Administration is not adequately monitoring India licenses with reporting 
conditions 

Within Export Administration, the Office of Exporter Services (OExS) is responsible for 
monitoring exporter compliance with five of the seven reporting conditions, including Write 
Your Own conditions that have reporting requirements. Of these five conditions, four involve 
the submission of routine documentation, such as delivery verification, that does not require a 
level of technical expertise to verify. If a licensing officer marks a license with any of these four 
conditions, the license is automatically entered into the Follow-Up Subsystem, enabling OExS to 
follow up with the applicable exporters to ensure that the required documentation is submitted in 
accordance with the condition. 

By contrast, Write Your Own conditions are unique and for each one, the licensing officer must 
determine whether the condition needs to be entered into the Follow-Up Subsystem. Write Your 
Own conditions may sometimes require the exporter or end user to provide BIS substantive 
reports related to the export, such as maintenance reports or technology control plans (TCPs), 31 
which require some level of technical review. For these conditions, the licensing officer must 
choose “yes” or “no” in the Write Your Own screen indicating first whether the condition 
requires follow-up. If the licensing officer marks “yes” for follow-up, he then must indicate 
whether the documentation requires a licensing officer’s technical review. The license is only 
entered into the Follow-up Subsystem if the officer marks “yes” for “follow-up” required. 

Of the 273 India export license applications included in our sample, only 13 contained reporting 
conditions that fell under the responsibility of OExS to monitor. Twelve of the 13 licenses 
contained a Write Your Own condition, whereas the 13 th license contained a standard reporting 
condition requiring the submission of a report summarizing specific details related to 
demonstrations of the item. Based on our review of these 13 licenses, licensing officers failed to 
mark 5 of them for follow-up to verify that the reporting conditions were met. We also found 
that staff from OExS were not fully aware of the reporting conditions they were required to 
monitor and were not properly referring noncompliant exporters to Export Enforcement. This 
breakdown in Export Administration’s monitoring process might diminish the deterrent effect 
that license conditions can have on potential violators. 


30 U.S. Department of Commerce Office of Inspector General (Commerce OIG), June 1999. Improvements Are 
Needed to Meet the Export Licensing Requirements of the 21st Century, IPE-11488; Commerce OIG, March 2003. 
Improvements Are Needed to Better Enforce Dual-Use Export Control Laws, IPE-15155; Commerce OIG, March 
2006. U.S. Dual-Use Export Controls for China Need to be Strengthened, IPE-17500. 

3 ‘According to BIS, a TCP is a reporting requirement put in place by BIS or Defense in cases when foreign nationals 
are employed at or assigned to security-cleared facilities that handle export-controlled items or information. 
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Licensing Officers are not properly marking the “follow-up ” box in ECASS for India licenses 
with Write Your Own conditions 


We found that 5 of the 13 licenses that contained a reporting requirement as part of the Write 
Your Own condition, were not marked for “follow-up” by the licensing officers. These errors 
occurred despite the fact that each export license application was reviewed and signed off by a 
countersigner. 32 Because these licenses were not entered into the Follow-up Subsystem, OExS 
staff did not know to follow up with the exporters to determine whether they had complied with 
the conditions. 

Regardless, two exporters provided the required documentation to OExS. However, OExS did 
not have any information pertaining to the remaining three licenses. Export Enforcement’s 
Office of Enforcement Analysis (OEA) later informed us that two of the remaining three licenses 
had been shipped against. However, OEA did not have any records relating to the third license. 33 

In response to similar monitoring weaknesses identified in our March 2006 report on dual-use 
export controls for China, the director of OExS issued a memorandum on May 9, 2006, 
reminding licensing officers of the importance of marking a license for follow-up. 34 We do not 
know whether the May 2006 memo has improved officer compliance with this requirement since 
the five licenses not marked for follow-up were processed before this memorandum was issued. 
Under the circumstances, we suggest that OExS review a sample of license applications to see 
whether licensing officers and countersigners are consistently marking the appropriate licenses 
for follow-up. Additionally, OExS should contact exporters for the three licenses that were not 
properly marked for follow-up to determine whether they complied with their reporting 
requirement. 

Licensing officers are not required to review all technical documentation submitted by exporters 
or end users pursuant to license conditions 

Of the 13 India licenses that had reporting conditions, we found that 10 required submission of 
technical documentation but were not marked for and did not receive the licensing officers’ 
review. Reporting requirements are designed to address particular concerns that either BIS or 
other licensing referral agencies had about the parties to the transaction or about the transaction 
itself. In these 10 cases, the licensing officers informed us that because Defense had requested 
the technical reporting conditions, they did not believe that they were responsible for reviewing 
the documentation. While Defense may have requested these conditions, BIS ultimately agreed 
to issue the licenses with the conditions. 

Two of the 10 licenses had conditions that required the end user or consignee to develop and 
implement a technology control plan prior to shipment. Seven licenses required the exporter to 
submit a service report on the condition and use of the commodity covered under the license, 
following any maintenance performed on the equipment. In the last case, the condition required 


32 A countersigner is typically a division director. The countersigning process was established by BIS to help ensure 
that export license applications are processed appropriately. 

33 Licenses are generally issued for a period of 2 years and the exporter can ship anytime during that period. 

This license expires in May 2007. 

34 Memorandum from the Director of OExS to BIS Licensing Officers, Review of Technical Reports Submitted 
Pursuant to a License Condition, May 9, 2006. 
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submission of a biannual report to BIS summarizing specific details related to the demonstrations 
of the item. Aside from licensing officer review, there are no BIS processes in place for 
reviewing the technical documentation to ensure that exporters or end users comply with such 
license conditions. 

Prior to May 2006, BIS did not require any form of technical review of the documentation 
submitted to ensure that it meets the requirements of the condition. In response to similar 
concerns in our March 2006 report on export controls for China, the May 9, 2006, OExS 
memorandum additionally required licensing officers to review technical documentation 
submitted pursuant to a license condition if the documentation was requested because of 
concerns with the transaction. However, the memorandum excludes those licenses involving 
reporting conditions placed on a license by the Defense Department unless BIS licensing officers 
also have a concern with the transaction. 

With regard to reporting requirements placed on a license as a condition of approval by Defense, 
BIS reported that Defense has the ability to identify technical reports it wishes to review and BIS 
provides those reports to them accordingly. BIS further reported that if Defense identifies a 
problem during its review of the reports, DOD will notify BIS of a compliance issue and raise 
this in future reviews of license applications involving the applicable exporter. The Acting 
Under Secretary for Industry and Security stated that he did not know whether Defense actually 
requests copies of technical reports required as part of license conditions. Based on our 
discussions with two of the licensing officers who were responsible for several of the licenses 
referenced above that had technical reporting conditions, it appears that these reports are not 
routinely provided to Defense. 

BIS has the authority to administer and enforce the EAR and, as such, is ultimately responsible 
for monitoring and enforcing all conditions placed on a dual-use license. Without knowing 
whether an exporter or end user is fully compliant with license conditions, BIS cannot make 
informed decisions on future license applications involving the same parties or take appropriate 
enforcement action on the current license. BIS should revise its procedures with respect to the 
review of technical documentation by licensing officers to require that all technical 
documentation requested by any licensing agency, and included in an approved license, be 
examined by the appropriate licensing officer upon submission by the exporter to ensure 
compliance with the reporting conditions. 

OExS staff are not always aware of the reporting conditions they are required to monitor 

Our review of the 13 licenses with reporting conditions also revealed that OExS staff (1) 
prematurely closed out two India licenses that required reporting documents from the exporter or 
end user, and (2) failed to forward shipping documentation received for one license to OEA. 

• Licenses prematurely closed out. In the first case, 35 OExS staff did not have any 

information documenting whether the license was shipped against and could not explain why 
it was prematurely closed out of the Follow-up Subsystem. However, OEA officials 
apparently had information indicating that the goods had been exported. In the second 


35 This license required the submission of a delivery verification report, which is provided to BIS after delivery of 
goods, and a maintenance report, provided when maintenance is performed on equipment. 
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case, 36 OExS staff had information relating to the date the goods were shipped, but they 
could not explain why they closed the license out in the Follow-Up Subsystem before 
receiving the required documentation. According to BIS procedures instituted in early 2005 
in response to a recommendation from our March 2003 export enforcement report, 37 OExS 
staff must obtain all required documentation from the exporter or end user before closing out 
a license. 

• Failure to forward shipping documentation to OEA. OExS staff failed to forward 
shipping documentation they received for one license to OEA so that a PSV could be 
initiated. This case involved a shipper’s export declaration and a post-shipment report, both 
of which should have been submitted directly to OEA by the exporter, but were mistakenly 
submitted to OExS after the May 2006 shipment. According to a memorandum issued by the 
director of OExS in March 2006, OExS staff must forward misrouted shipper’s export 
declarations and all relevant documentation to OEA within 48 hours of receipt of those 
documents. An OExS employee said that she did not forward the shipping documentation to 
OEA because she believed monitoring the license conditions in this case was the 
responsibility of OExS. But if OEA does not receive shipping documents, it has no way of 
knowing whether exporters have complied with the license condition and cannot initiate a 
PSV. 

BIS should ensure that OExS staff understand which license conditions they are responsible for 
monitoring and when they should forward documentation to OEA. In addition, OExS should 
reopen the two licenses that were prematurely closed out of its system and contact the exporters 
to obtain the documentation needed to fulfill the reporting requirements. 

OExS staff are not referring non-comyliant exporters to OEE 

According to BIS’ guidance, OExS staff are required to follow up with exporters that are 
noncompliant with reporting conditions prior to closing out the license in the Follow-Up 
Subsystem. The procedures further state that if exporters are non-responsive to requests for 
information, OExS staff should refer them to the Office of Export Enforcement (OEE). 

However, in the two cases of noncompliance, both exporters had shipped against their licenses, 
but neither one had provided BIS all of the required documentation as of October 2006. We 
brought these cases to the attention of OExS staff members during the course of our review, but 
they were not referred to OEE. OExS should immediately refer any noncompliant exporters to 
OEE. 

Recommendation: 


BIS should, at a minimum, take the following actions to improve its monitoring of license 
conditions: 

• Determine why there are persistent breakdowns in BIS’ process for monitoring license 
conditions. 


36 This license required the submission of a demonstration report to BIS every 6 months for a period of 2 years. 
37 Commerce OIG, March 2003. Improvements Are Needed to Better Enforce Dual-Use Export Control Laws, IPE- 
15155. 
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• Review a sample of license applications to ensure licensing officers and countersigners are 
properly marking licenses for follow-up. 

• Contact exporters for the three licenses we identified as not marked for follow-up to 
determine whether the exporters complied with reporting requirements. 

• Amend procedures to require licensing officers to review all technical documentation 
submitted by exporters or end users to ensure their compliance with the conditions. 

• Ensure that relevant OExS staff know which license conditions they are responsible for 
monitoring and the steps they should be taking to follow up on license conditions, including 
referral to OEE, as appropriate. 

• Reopen the two licenses that were closed by OExS and contact the exporters regarding 
reporting requirements. 

• Refer all noncompliant exporters to the Office of Export Enforcement. 


BIS Response to OIG Draft Report and OIG Comments 

In its written response to our draft report, BIS stated that it is still reviewing our 
recommendations pertaining to Export Administration’s monitoring of license conditions. The 
planned completion date for this review is April 30, 2007. We look forward to reviewing BIS’ 
response when completed. 


B. Export Enforcement needs to improve its monitoring and enforcement of India licenses 
with condition 14 

Within Export Enforcement, OEA is responsible for monitoring licenses marked with the 
remaining two reporting conditions-the submission of shipper’s export declarations, which is 
referred to as condition 14, and post shipment reports on high-performance computer exports to 
certain countries, referred to as condition 34. 38 Licenses with condition 14 require a PSV on a 
specific foreign entity following the first shipment made against the license. Within 30 days of 
shipment, exporters are required to submit a copy of the shipper’s export declaration directly to 
OEA, which then initiates the PSV to confirm a commodity’s stated end-use 

Our review of the 24 India licenses from our sample that contained condition 14 revealed that 
OEA is not fully adhering to its guidance for monitoring licenses with condition 14. Condition 
14 is one of the most critical conditions placed on a license because either the interagency 
licensing agencies or export enforcement officials decided that a PSV was needed to determine 
whether the goods or technology were actually being used in accordance with that license. 


38 Since licenses with condition 34 are tracked separately from Export Enforcement’s Conditions Follow-up 
Subsystem, we focused our review on licenses with condition 14. However, some of the licenses with condition 14 
in our sample also contained condition 34. 
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However, it should be noted that even when condition 14 is imposed on a license, the PSV might 
not occur in all cases. For example, if there is no export against the license or if the agency 
requesting this condition changes its mind (e.g., the item subsequently becomes decontrolled), 
the PSV may be cancelled. One of the 24 PSVs in our sample was cancelled because the item 
was decontrolled after the license was issued. 

Of the reviewed India licenses that contained condition 14, several exporters submitted their 
shipping documents to BIS well after the established time frame, which in some cases hinders 
BIS’ ability to detect possible diversions or violations of license conditions. In addition, OEA 
recommended approval of additional licenses to exporters that had not fully complied with 
condition 14 reporting requirements on previous licenses and did not refer noncompliant 
exporters to OEE for appropriate action. 

Export Enforcement management is unable to determine whether OEA analysts and supervisors 
are fully adhering to OEA’s follow-up procedures 

We determined that exporters submitted their shipper’s export declarations after the established 
30-day deadline in 11 of the 24 cases—between 12 and 1,158 days beyond the deadlines (see 
figure 6). In response to our March 2003 export enforcement report, BIS issued procedures 
requiring its staff to follow up at least twice with the exporter on all licenses with condition 14: 
first, 1 year after the license’s date of issue and then within 30 days of the date of license 
expiration to see whether shipments have occurred. However, we were unable to determine if 
OEA followed these procedures in these cases. Specifically, records in OEA’s electronic follow¬ 
up tickler system for 8 of the 11 licenses 39 in which exporters submitted their shipper’s export 
declarations late did not clearly show what actions were taken to monitor compliance. Seven of 
the 8 records only showed the date when the follow-up tasks were assigned to an analyst and not 
what actions the analyst took. The remaining record did not provide any information about OEA 
follow-up. 

Given that the acting director for OEA’s South Asia and Europe Division was new to this 
position at the time of our review and the fact that OEA’s follow-up tickler system did not 
clearly indicate what follow-up action, if any, was taken in these cases, she could not confirm if 
analysts followed the prescribed procedures for these eight cases. Since only OEA supervisors 
have access to the Follow-up Subsystem, it was their responsibility to record what actions were 
taken by the analysts in these cases. However, the acting director for OEA’s South Asia and 
Europe Division suggested that supervisors would be better able to hold analysts accountable if 
the analysts had access to the Follow-up Subsystem so that they could record the actions they 
took to monitor these cases. 


39 One exporter was under investigation by OEE at the time of our review, so we did not pursue our inquiry related to 
this license. While the remaining two licenses had been shipped against, they were granted in March 2006 and, as 
such, had not reached the one-year mark requirement for follow-up as called for in OEA’s guidance. 
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Figure^ExportersNoncompliantwithCondition^RegortingRequirement^ 



I Number of Days SEDs Were Received Beyond the 30-day 

Requirement 

Source: BIS 

OEA is not denying noncomyliant exporters future licenses or referring them to OEE per its 
guidance 

OEA’s procedures require its analysts to (1) refer noncompliant condition 14 exporters to OEE 
for possible investigation, and (2) recommend denial of any subsequent license applications 
involving a party who has not complied with a previous license condition. We found also that at 
least 6 of the 11 noncompliant exporters in our sample received additional licenses after the 1- 
year deadline established by OEA for its analysts to follow up with exporters to determine 
compliance with condition 14. 

In addition, only 2 of the 11 exporters that submitted their shipping documents to OEA after the 
established deadline were referred to OEE. The director of OEA informed us that while he was 
aware of the other 9 noncompliant exporters, he made the decision not to make the referrals. He 
and the acting director for the South Asia and Europe Division stated that despite BIS’ guidance, 
they generally do not refer these types of cases to OEE because they believe these cases would 
not be a priority. 

We discussed this matter with the director of OEE, and he stated that OEA should refer these 
types of cases. He stressed that these violations should be examined so that they can consider 
appropriate enforcement action (e.g., a warning letter or fine). 

BIS needs to ensure that its analysts and supervisors closely monitor licenses at the 1-year mark 
and within 30 days of license expiration to prevent additional licenses from being issued to 
exporters that do not comply with condition 14, and it should hold those exporters accountable. 
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Recommendation: 


BIS needs to review Export Enforcement’s process of monitoring and enforcing license 

condition 14 and take the following actions: 

• Require OEA analysts and supervisors to closely monitor licenses at the specified follow-up 
time frames, record their monitoring activities in the Conditions Follow-up Subsystem, and 
recommend that exporters who do not comply with condition 14 be denied additional 
licenses. 

• Refer all noncompliant exporters to the Office of Export Enforcement. 

• Hold exporters accountable for noncompliance with condition 14 through appropriate 
enforcement action. 


—--*»**$tt*M-- 

BIS Response to OIG Draft Report and OIG Comments 

In its written response to our draft report and our recommendation addressing Export 
Enforcement’s license monitoring and enforcement efforts, BIS stated that it is still reviewing the 
first part of this recommendation to determine whether it can be implemented using the current 
license processing system (ECASS), or if some alternative approach is necessary. We look 
forward to learning of BIS’ decision upon completion of its review. 

As for the second part of our recommendation related to BIS’ adherence to its own guidance on 
denying licenses to those exporters who do not comply with condition 14 and/or referring 
noncompliant exporters to OEE, BIS stated that this requirement needs modification. 

Specifically, BIS reported that it put this requirement into place in October 2003 in response to a 
previous OIG recommendation, but found that there were many factors involved that needed to 
be considered before determining whether subsequent licenses should be denied or referrals 
made to OEE based on a late filing. As such, BIS stated that in cases where OEA believes it is 
appropriate to refer an investigative lead to OEE, it does so while also screening the party 
involved and recommending against issuance of any license until the OEE investigation has been 
concluded. 

While we agree that some flexibility might be warranted (e.g., if the exporter is just a few days 
late in providing the required shipping documentation) in determining whether future licenses 
should be denied or referrals made to OEE based on a late filing, we found no evidence in the 
case files to indicate any type of analysis was conducted to determine whether or not the late filer 
should be held accountable for not fully complying with the license condition. In fact, as 
discussed in our report, the director for OEA and the acting director for the South Asia and 
Europe Division stated that they generally do not refer these types of cases to OEE because they 
believe these cases would simply not be a priority. Nonetheless, the director of OEE informed us 
during our review that these types of cases should be referred to OEE so that they can consider 
appropriate enforcement action, such as a warning letter. Therefore, we reaffirm our 
recommendations on these matters and ask that BIS address them in its action plan. 
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With regard to the part of our recommendation about holding exporters accountable for 
noncompliance with condition 14 through appropriate enforcement action, BIS’ response stated 
that its Office of Chief Counsel and OEE, as well as the Department of Justice, determine the 
appropriate investigation and prosecution for filing documentation late, based on all the facts 
present. While we agree that these three entities, as appropriate, should make the decision as to 
what type of investigation and/or prosecution is appropriate on any given case, as stated above, 
none of the nine cases highlighted in our report were referred to these offices so that an 
appropriate decision could be made. As such, we reaffirm this part of our recommendation on 
this matter and ask that BIS address it in its action plan. 

Finally, BIS’ response noted that the 24 licenses from our sample did not all contain condition 
14. We disagree. Our review of these licenses indicated that all 24 contained the standard 
condition 14 language: 

After the first shipment is made against this license, send one copy 
of your shipper’s export declaration, or automated export system 
(AES) record, bill of lading or airway bill to the Department of 
Commerce within 30 days of the date of export. Indicate the 
license number on each document. Send these documents to the 
Bureau of Industry and Security, Office of Enforcement Analysis, 

Room 4065, 14 th Street and Constitution Avenue, N.W., 

Washington, D.C. 20230. These documents must be received by 
certified mail or via a private courier. They may not be faxed. 

While the licensing officers for 2 of the 24 licenses had improperly coded this condition in 
EC ASS as a “Write Your Own” condition instead of condition 14, the intent of the condition was 
clearly for a PSV to be conducted. In addition, the exporters in these cases were still required to 
submit the appropriate shipping documents in accordance with the license terms. 
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SUMMARY OF UNCLASSIFIED RECOMMENDATIONS 

We recommend that the Acting Under Secretary for Industry and Security ensure that the 

following actions are taken: 

1. Specifically list all of the Indian entities that should be captured on BIS’ Entity List, or 

determine an alternative means to better ensure exporter compliance with export license 

requirements (see page 13). 

2. Improve Export Administration’s license monitoring efforts by: 

a. Determining why there are persistent breakdowns in BIS’ process for monitoring 
license conditions (see page 18). 

b. Reviewing a sample of license applications to ensure licensing officers and counter¬ 
signers are properly marking licenses for follow-up (see page 18). 

c. Contacting exporters for the three licenses cited in this report that licensing officers 
did not mark for follow-up to determine exporters’ compliance with reporting 
requirements (see page 18). 

d. Amending BIS procedures to require licensing officers to review all technical 
documentation submitted by exporters or end users to better ensure their 
compliance with the conditions (see page 18). 

e. Ensuring that relevant Office of Exporter Services staff know which license 
conditions they are responsible for monitoring and the steps they should be taking 
to follow up on license conditions, including referral to the Office of Export 
Enforcement, as appropriate (see page 18). 

f. Reopening the two licenses that were closed by Office of Exporter Services staff 
and contacting the exporters regarding reporting requirements (see page 18). 

g. Referring any noncompliant exporters to the Office of Export Enforcement (see 
page 18). 

3. Improve Export Enforcement’s license monitoring and enforcement efforts by: 

a. Requiring Office of Enforcement Analysis analysts and supervisors to closely 
monitor licenses at the specified follow-up time frames, recording their monitoring 
activities in the Conditions Follow-up Subsystem, and recommending that exporters 
who do not comply with condition 14 be denied additional licenses (see page 22). 

b. Referring all noncompliant exporters to the Office of Export Enforcement (see page 

22 ). 

c. Holding exporters accountable for noncompliance with condition 14 through 
appropriate enforcement action (see page 22). 
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ACEP 

BIS 

CCL 

CIA 

EAR 

ECASS 

ECCN 

ECO 

FY 

HTCG 

IPE 

NDAA 

NLR 

NSSP 

oc 

OEA 

OEE 

OExS 

OIG 

PLC 

PSV 

TCP 

WINPAC 

WMD 


APPENDIXES 

Appendix A: Acronyms 

Advisory Committee on Export Policy 
Bureau of Industry and Security 
Commerce Control List 
Central Intelligence Agency 
Export Administration Regulations 
Export Control Automated Support System 
Export Control Classification Number 
Export Control Officer 
Fiscal Year 

High Technology Cooperation Group 
Inspections and Program Evaluations 
National Defense Authorization Act 
No License Required 
Next Steps in Strategic Partnership 
Operating Committee 
Office of Enforcement Analysis 
Office of Export Enforcement 
Office of Exporter Services 
Office of Inspector General 
Pre-License Check 
Post-Shipment Verification 
Technology Control Plan 

Center for Weapons Intelligence, Nonproliferation, and 
Arms Control 

Weapons of Mass Destruction 
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Appendix B: Interagency Dual-Use Export Licensing Process 



Source: Office of Inspector General 
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Appendix C: BIS Management Response to Draft Report—Unclassified Version 



UNITED STATES DEPARTMENT OF COMMERCE 
Under Secretary for Industry and Security 

Washington, D.C. 20230 

March 23,2007 


MEMORANDUM FOR Johnnie Frazier 
Inspector General 

FROM: ^Mark Foulon, Acting 

SUBJECT: Audit Report No. IPE-18144 

Draft Report Date: February 23,2007 
Audited Entity: Bureau of Industry and Security 


Attached are the Bureau of Industry and Security’s comments addressing the Office of the 
Inspector General’s draft report entitled: U.S. Dual Use Export Controls for India Should 
Continue to Be Closely Monitored. Draft Inspection Report No. IPE-18144. February 2007 . 

The response consists of two parts. First are comments on the unclassified report’s text and 
recommendations, followed by BIS’s response to the report’s classified text and 


Attachment 
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COMMENTS: 

TTS n^iql Tlgy ff.Tpnrf Pnnfrnk fnr India ShnnlH fniitinnp in Up finely Mnnifnrprf, 


Draft Insnection Renort No. IPE-18144. Februarv 2007 

Comments on the Report’s Unclassified Text: 

p. ii 

For reasons discussed in the classified section, BIS believes that India has fulfilled its 
commitments under the NSSP. 

p. iii 

In the classified section of the report, BIS explains the reasons for its disagreements 
with certain of the report’s findings as stated on this page. 

p. iv 

For reasons discussed in the classified section of the report, BIS believes that 
performing 8 of 24 PSVs within 100 days of shipment is not a disadvantage. 

p. 14 

For reasons discussed in the classified section, BIS believes that India has fulfilled its 
commitments under the NSSP. 

P-15 

There were two cases in the Operating Committee (OC) in which there was confusion 
about whether, or how, a proposed ultimate consignee was on the Entity List. In one 
of the two cases, the confhsion was based on erroneous information provided by the 
applicant. 

p. 17 

In the classified section of the report, BIS explains the reasons for its disagreements 
with certain of the report’s findings as stated on this page. 

pp. 20-21 

On a monthly basis, Defense identifies reports it wishes to review and Commerce 
provides those reports. If Defense requested copies of technical reports it required as 
license conditions, those reports would be provided to Defense for its review. Thus, 
there is a process for Defense to request reports it required in license conditions. If its 
review of those reports were to identify an issue, it would notify Commerce as a 
compliance issue and raise this in any future license application involving the 
exporter. 

P- 23 

The characterization of condition 14 as “one of the most critical conditions” because 
it means that the interagency has decided that a post-shipment verification check 
(PSV) was needed, reflects a misunderstanding of the PSV process, as well as the 
purpose of condition 14. License condition 14, which specifically requests the 
licensee to submit shipping documents to BIS within 30 days of the first shipment, is 
used in instances where Export Enforcement personnel review documentation and 
initiate a PSV at a later point in time. It can also be imposed on the licensee by the 
licensing officer when another agency requires that a PSV be conducted as a 
condition of approval. However, even when condition 14 is imposed, the PSV might 
not occur, for example, if there is no export against the license or if the agency 
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requesting this condition cancels the request. Commerce has the authority to initiate a 
PSV at any time, regardless of whether it is included as a condition of the license or 
whether the license contains condition 14, and independent of the interagency 
process. Indeed, not all PS Vs require condition 14, and not all licenses with 
condition 14 result in PS Vs. Of the 24 India licenses containing PS Vs noted in the 
report, 10 either did not contain condition 14 or the condition was not placed on the 
license by the interagency, but by an OEA analyst. 

Response to the Report’s Recommendations: 

Recommendation 1: Specifically list all Indian entities that should be captured on BIS’ Entity 
List, or determine an alternative means to better ensure exporter 
compliance with export license requirements (see page 14). 

BIS Response: 

BIS will review the listing of the Indian entities on the Entity List to determine how additional 

information can be provided to exporters. The planned completion date for this review is 

April 30,2007. 

Recommendation 2: Improve Export Administration’s license monitoring efforts by: 

a Determine why there are persistent breakdowns in BIS’ process for monitoring 
license conditions (see page 19). 

b Reviewing a sample of license applications to ensure licensing officers and 
counter-signers are properly marking licenses for follow-up (see page 19). 

c Contacting exporters for the three licenses cited in this report that licensing 
officers did not mark for follow-up to determine exporters’ compliance with 
reporting requirements (see page 19). 

d Amending BIS procedures to require licensing officers to review all technical 
documentation submitted by exporters or end users to better ensure their 
compliance with the conditions (see page 19). 

e Ens uring that relevant Officer of Exporter Services staff know which license 

conditions they are responsible for monitoring and the steps they should be taking 
to follow up on license conditions, including referral to the Office of Export 
Enforcement, as appropriate (see page 19). 

f Reopening the two licenses that were closed by Office of Export Services staff 
and contacting the exporters regarding reporting requirements (see page 19). 

g Referring any noncompliant exporters to the Office of Export Enforcement (see 
page 19). 

BIS Response: 

BIS is reviewing these seven recommendations. The planned completion date for this review is 

April 30,2007. 
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Recommendation 3: Improve Export Enforcement’s license monitoring and enforcement 
efforts by: 

a. Requiring Office of Enforcement Analysis analysts and supervisors to closely monitor 
licenses at the specified follow-up time frames, recording their monitoring activities in 
the Conditions Follow-up Subsystem, and recommending that exporters who no not 
comply with condition 14 be denied additional licenses (see page 23). 

b. Referring all noncompliant exporters to the Office of Export Enforcement (see page 23.) 

c. Holding exporters accountable for noncompliance with condition 14 through appropriate 
enforcement action (see page 23). 

BIS Response: 

a. BIS is reviewing the first part of this recommendation to determine if it can be 
implemented using the current license processing system (ECASS), or if some alternative 
approach is necessary. 

The second part of the recommendation, to deny licenses to those exporters who do not comply 
with condition 14, requires modification. BIS put this requirement into place in October 2003 in 
response to a previous OIG recommendation, but found that there were many factors involved 
that needed to be considered before BIS should determine to deny subsequent licenses. Thus, 
BIS believes it is more appropriate to consider all of the factors related to a late filing prior to 
referral to a criminal investigator. In cases where the Export Compliance Analyst believes it is 
appropriate to refer an investigative lead to OEE, OEA does so and also screens the party 
involved and recommends against issuance of any license until the OEE investigation has been 
concluded. 

b. As explained above, BIS/OEA considers all of the factors related to a late filing and, if 
circumstances warrant, refers the matter to OEE for investigation. 

c. The Office of Chief Counsel, Office of Export Enforcement, and the Department of 
Justice determine the investigation and prosecution that is appropriate for filing documentation 
late, based on all facts present. 
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Survey of Selected Aspects of the CFIUS Process 

Given the current interest in the Committee on Foreign Investment in the United States (CFIUS) 
both within and outside the U.S. government, we followed up on our March 2000 findings and 
recommendations 1 related to select aspects of CFIUS’ monitoring of foreign investment for 
national security reasons. While we still have questions about the effectiveness of the overall 
CFIUS process, considerable improvements have been made with regard to the CFIUS activities 
handled within the Commerce Department. We believe these improvements provide for better 
coordination among departmental bureaus and greater transparency in Commerce’s decision¬ 
making process. 


BACKGROUND 


CFIUS was established by Congress in 1975 for the purpose of monitoring and evaluating the 
impact of foreign investment in the United States. In 1988 the committee’s responsibilities were 
expanded under the Exon-Florio amendment to 
the Defense Production Act of 1950. Exon- 
Florio authorizes the President to suspend or 
prohibit any foreign acquisition, merger, or 
takeover of a U.S. company that threatens 
national security. The provision does not 
provide a precise definition of national security; 
rather it gives the U.S. government the ability 
to redefine that term to keep pace with 
technological and political developments and 
address emerging threats as they arise. CFIUS 
is comprised of 12 federal agencies and chaired 
by the Secretary of the Treasury (see Figure 1). 

While members of the intelligence community 
are not voting members of CFIUS, they do 
provide intelligence assessments on all cases. 


Overall CFIUS Process 


Figure 1: CFIUS Member Agencies 

U.S. Department of the Treasury 

U.S. Department of State 

U.S. Department of Defense 

U.S. Department of Commerce 

U.S. Department of Homeland Security 

U.S. Department of Justice 

U.S. Trade Representative 

Office of Management and Budget 

Council of Economic Advisors 

National Security Council 

National Economic Council 

Office of Science and Technology Policy 

Source: Department of the Treasury 


Either the U.S. company or the foreign entity involved in an acquisition of or investment in a 
U.S. company may submit a voluntary notice, or “filing,” of the transaction to CFIUS. In 
addition, under Exon-Florio, a committee member can submit a notice of a proposed or 
completed acquisition for a national security review. If the committee agrees that the transaction 
raises national security concerns, the CFIUS staff chair will contact the parties and request a 
filing. If the parties do not file, any CFIUS member can initiate the filing. 


'U.S. Department of Commerce Office of Inspector General (Commerce OIG), March 2000. Improvements are 
Needed in Programs Designed to Protect Against the Transfer of Sensitive Technologies to Countries of Concern, 
IPE-12454-1. 
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Once the committee receives a complete CFIUS filing from a company, it has 30 days to 
determine whether the transaction involves national security concerns that should be 
investigated. Because of the limited time frame for the reviews, the committee encourages 
companies to pre-file before submitting documentation for an official 30-day review. Pre-filing 
helps CFIUS evaluate the notifications for any errors or inconsistencies. 

If any member of CFIUS has national security concerns regarding the transaction, the committee 
conducts a 45-day investigation. During the investigation, the agency/agencies requesting the 
investigation are responsible for information gathering, analysis, and drafting the report and 
recommendation to the President. Other CFIUS members may be involved in the investigation if 
they have relevant expertise and issues of concern. Upon completion of the investigation, the 
President has 15 days to decide whether to prohibit the transaction or allow it to go forward. 
Upon completion of his review, the President sends a classified report to the Congress, stating 
his decision and explaining his reasons. 

It should be noted that sometimes a transaction is still allowed to proceed, even when a CFIUS 
member has concerns with the transaction. In these cases, the CFIUS member may enter into a 
mitigation agreement with the parties. These agreements are aimed at minimizing the threat to 
national security—while still allowing the transaction to move forward—by requiring the parties 
in the transaction to establish and implement a set of security and other measures. 

Commerce’s Internal CFIUS Review Process 


Within Commerce, the Secretary has delegated responsibility for coordinating the Department’s 
evaluation of CFIUS filings to the International Trade Administration (ITA). However, the 
Bureau of Industry and Security (BIS) also plays a critical role in Commerce’s CFIUS activities. 
In addition, the Deputy Secretary is kept apprised of CFIUS cases under review, and may be 
called upon to decide the Department’s position in a specific case if ITA and BIS cannot agree. 

Prior to April 2006, the Deputy Under Secretary for ITA was responsible for coordinating the 
evaluation of CFIUS notifications within Commerce. Since then, ITA’s Assistant Secretary for 
Market Access and Compliance has had the policy lead on CFIUS efforts. However, ITA’s 
Manufacturing and Services’ Office of Competition and Economic Analysis (OCEA), where the 
CFIUS coordinator resides, provides the actual working-level support on CFIUS cases. Since 
the designation of a new CFIUS coordinator in October 2006, ITA’s recommendations are now 
presented in writing to the Assistant Secretary for Market Access and Compliance. Additionally, 
the new CFIUS coordinator requires that the following documents be included in each CFIUS 
case file that ITA reviews: 

• Business Fact Sheet. This document provides basic information about the businesses and 
industries involved in the proposed transaction. On a pilot basis, OCEA is sharing the 
fact sheets with BIS and the other “economic” agencies within CFIUS (i.e., the United 
States Trade Representative, State, the Council of Economic Advisors, and the Office of 
Science and Technology Policy). ITA has not yet decided if it will share these fact sheets 
with the entire CFIUS group. 
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• Analysis Memorandum. Relevant Manufacturing and Services units (e.g., Aerospace and 
Autos, Materials and Machinery, Technology and Electronic Commerce) are required to 
prepare an in-depth analysis of the proposed transaction and present recommendations on 
whether it is appropriate for ITA to clear the case. 

Within BIS, the responsibility for reviewing CFIUS notifications is assigned to Export 
Administration’s Office of Strategic Industries and Economic Security (OSIES). In general, this 
office is responsible for a wide range of issues that relate to both the national and economic 
security of the United States. As a participant in the Department’s CFIUS process, OSIES’ role 
is to ensure that foreign investment will not negatively impact the U.S. defense industrial base’s 
capacity and capabilities to meet current and future national security requirements. The office’s 
database on CFIUS filings is the only comprehensive database on CFIUS filings available in the 
Department. In addition, BIS’ Export Enforcement units screen all parties associated with 
CFIUS filings to ensure that there are no export enforcement concerns relevant to the CFIUS 
case under review. 

ITA coordinates the Department’s response on CFIUS notifications through its CFIUS Working 
Group. The group meets weekly and mainly consists of representatives from ITA and BIS. The 
Department’s Office of General Counsel also participates on occasion when legal expertise is 
required. Additionally, the CFIUS Working Group consults with other Commerce bureaus on a 
case-by-case basis. For example, the National Institute of Standards and Technology was 
consulted on a case involving voting machines, and the National Telecommunications and 
Information Administration was consulted on a case involving a company that manufactured 
network security products. ITA prepares a weekly report summarizing all pending CFIUS cases 
for the Deputy Secretary’s review. In addition, the Deputy Secretary attends “Deputy meetings” 
at the Department of the Treasury on CFIUS matters, on an as needed basis. 

CFIUS Notifications 


Between 2000 and 2006, CFIUS reviewed 442 foreign acquisitions of U.S. companies for 
potential national security concerns. In 2006 CFIUS reviewed 113 filings, a 74 percent increase 
over 2005 and more than twice the average number for the past 6 years (see Figure 2). 

Commerce and Treasury officials attribute this spike in filings to the increased attention to 
foreign mergers and acquisitions in the aftermath of the 2006 purchase of a British company that 
managed terminal operations at six key U.S. ports by Dubai Ports World, a United Arab Emirates 
company. This trend in the number of CFIUS filings appears as if it will continue in 2007, as 29 
transactions were filed as of mid-March. 
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Figure 2: Number of CFIUS Notifications 


CFIUS Notifications in Calendar Years 2000-2006 



2000 2001 2002 2003 2004 2005 2006 


Source: The Department of the Treasury 

The majority of foreign investors involved in CFIUS notifications in 2006 were from the 
following six countries: United Kingdom, France, Israel, Canada, Australia, and Japan. While 
there were no filings involving foreign investors from China during this time frame, there was 
one filing involving a Hong Kong entity. Other foreign investors involved in CFIUS filings 
include entities from Pakistan, Russia, Venezuela, and the United Arab Emirates. 

2006 CFIUS Reforms and Pending Legislation 

Given the recent scrutiny of the effectiveness of the CFIUS process by the Congress in the 
aftermath of the Dubai Ports World case, the Department of the Treasury reports that CFIUS 
instituted the following reforms in 2006: 

• Although current law requires the President to report to the Congress on transactions that 
receive a presidential decision, CFIUS now provides briefings to the Congress on every case 
reviewed by CFIUS. 

• Only persons confirmed by the Senate can certify the conclusion of a CFIUS review. 

• CFIUS encourages parties to transactions to pre-file before filing a formal notice. 


The Treasury Department hosts a weekly policy-level meeting to discuss all pending CFIUS 
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• The Director of National Intelligence (DNI) was given a more formal role. Through the 
DNI, the intelligence community provides briefings on every transaction and participates in 
weekly CFIUS meetings. 

In addition, the U.S. House of Representatives passed legislation in February 2007 aimed at 

reforming the current CFIUS process. 2 Treasury officials expect the Senate to take up the bill in 

spring 2007. Below are the main provisions of the House bill: 

• Foreign government transactions . The bill requires CFIUS to conduct a 45-day national 
security investigation on all cases involving foreign government control unless the 
Secretaries of the Treasury, Homeland Security, and Commerce determine, on the basis of 
the 30-day review of the transaction, that it will not affect the national security of the United 
States. 

• Designation of Vice Chairs . The bill elevates the Secretaries of Commerce and Homeland 
Security to the status of Vice Chairs of CFIUS and requires that they approve all transactions 
in addition to the Chairman of CFIUS. 

• Unilateral Initiation of Reviews . The bill allows the President, CFIUS, or any member acting 
on behalf of CFIUS to initiate reviews of any previously reviewed or investigated transaction 
if any party to the transaction submitted false or misleading information or breached a 
mitigation agreement. 

• Withdrawn Notices . The bill establishes a process for tracking transaction notices that have 
been withdrawn by the parties before the completion of the 30-day review or 45-day 
investigation by CFIUS. 

• Annual Report to the Congress . CFIUS will be required to submit a report to the Congress 
before July 31 of each year on all reviews and investigations of transactions. 


UPDATE OF PRIOR COMMERCE OIG WORK ON CFIUS PROCESS 


In our March 2000 report on CFIUS and other matters, we raised concerns about the overall 
effectiveness of CFIUS’ monitoring of foreign investment in the United States for national 
security reasons, including (1) the lack of mandatory foreign investment reporting, (2) the low 
number of investigations conducted on company filings, and (3) the potential conflict of interest 
or appearance thereof by the Treasury office charged with overseeing CFIUS because of its dual 
responsibilities to “promote” foreign investment as well as “prevent” such investment when it 
could result in the loss of sensitive technology or a critical reduction in the defense industrial 
base. 


2 H.R.556, “National Security Foreign Investment Reform and Strengthened Transparency Act of 2007.” 
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The report also highlighted some issues involving Commerce’s process for reviewing CFIUS 
filings, including (1) whether Commerce’s lead responsibility for this program should remain in 
ITA, the Department’s primary trade promotion agency, or be moved to BIS, the Department’s 
primary national security agency, and (2) whether BIS’ export enforcement and export licensing 
units should play a larger role in reviewing CFIUS filings. 

To determine what actions have been taken to address these concerns, we met with various 
officials within ITA, including the Assistant Secretary for Market Access and Compliance, and 
BIS, including the Assistant Secretary for Export Administration and the director of the Office of 
Strategic Industries and Economic Security. We also met with the Department of the Treasury’s 
Deputy Assistant Secretary for Investment Security and the CFIUS staff chair. In addition, we 
reviewed current and proposed laws, policies, and procedures related to the CFIUS process. We 
also reviewed 10 CFIUS cases, including one from 2005 that was reopened in 2006 based on 
congressional concerns with the transaction, all 7 from 2006 that went to the investigation phase, 
and 2 from 2007 that raised possible export control issues. 

Given the limited nature of our work, we did not determine how many of the 113 filings were 
withdrawn and refiled with CFIUS and how well CFIUS monitors this process. We also did not 
review CFIUS’ process for monitoring compliance with mitigation agreements. 

The following two sections provide updates on the two areas of CFIUS concerns highlighted in 
our March 2000 report. 

A. Update of Prior Commerce OIG Concerns Related to the Overall CFIUS Process 

Lack of Mandatory Foreign Investment Reporting— Update 

During our recent follow-up work, both Treasury and Commerce officials informed us that the 
controversial and highly publicized Dubai Ports World case made U.S. and foreign entities more 
aware of the CFIUS process. As a result, the number of filings has increased. However, foreign 
investment reporting is still a voluntary process. Legislation was proposed in the National 
Defense Authorization Act for Fiscal Year 2000 to make such reporting to CFIUS mandatory, 
but the provision was deleted before passage of the bill. To date, Congress has not taken any 
action to make CFIUS filings mandatory. In addition, the Administration has not proposed 
mandatory filing. According to Commerce and Treasury officials, mandatory filing might harm 
U.S. open investment policy as well as overburden U.S. government resources. However, both 
agencies stated that even though filing with CFIUS is voluntary, it is in the best interest of the 
parties to an investment transaction to notify the committee because CFIUS retains the right to 
review any transactions not communicated to the committee, and the review could result in 
forced divestiture. 

While we acknowledge that the number of CFIUS filings has increased, we still question 
whether CFIUS is capturing—in a timely manner—all relevant acquisitions and mergers, 
especially those involving small or medium-sized U.S. companies that manufacture or conduct 
research on sensitive U.S. technologies (including emerging technologies). For instance, one of 
the 2006 cases we reviewed during our follow-up work involved a small U.S. company that had 
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been acquired a year earlier without CFIUS review. It is unknown why the U.S. company did 
not notify CFIUS of the proposed acquisition prior to its completion. The transaction was only 
brought to CFIUS’ attention a year after the acquisition occurred when it was highlighted by the 
media. Due to national security concerns, the U.S. government ultimately ordered the divestiture 
of the acquisition which has to be completed by December 2007. While there was no evidence 
in the case file to suggest national security had been compromised, reviewing such transactions 
after the fact increases the likelihood of this possibility. 

In addition, while CFIUS members are permitted to submit a notice of proposed or completed 
acquisition for a national security review, this does not happen very often. Specifically, the 
Department of the Treasury reported that it received six notifications from member agencies in 
2006, including four from Commerce. 

Low Number of Investigations —Update 

The number of 45-day investigations has increased since our March 2000 report (see Figure 3). 
Specifically, the percentage of filings investigated increased from 1 percent in 2000 to 6 percent 
in 2006. Of the 113 CFIUS filings in 2006, 7 cases were escalated to the investigation phase. 
However, since the number of filings also increased in this time period, it is hard to determine— 
based on the statistics alone—what this increase in investigations really means or how significant 
it is given that (1) a party can withdraw its filing before it is escalated to the investigation phase 
(although the expectation is that the party will refile the notice if the transaction is to proceed) 
and (2) CFIUS can enter into a mitigation agreement with a party to deal with any potential 
national security concerns before being escalated to the investigation phase. 

Of the seven cases escalated to investigation in 2006, only two required a presidential decision. 

In both cases, the President allowed the transaction to go forward. The remaining five cases 
were withdrawn before the investigation phase concluded and refiled later. CFIUS ultimately 
approved three of the five refiled transactions. In the fourth case, CFIUS required a divestiture, 
and the fifth transaction was abandoned by the parties involved. 
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Figure 3: Number of CFIUS Investigations 


CFIUS Investigations in Calendar Years 2000-2006 



2000 2001 2002 2003 2004 2005 2006 


Source: Department of the Treasury 


Dual Responsibilities of CFIUS Leadership- 


In our March 2000 report, we questioned whether the dual responsibilities of Treasury’s Office 
of International Investment, located in the Office of the Assistant Secretary of International 
Affairs, were incompatible. That office, which serves as the secretariat for CFIUS, is responsible 
for promoting foreign direct investment as well as investigating questionable foreign investment. 
While the lead responsibility for CFIUS continues to remain in this office, both Treasury and 
Commerce officials reported that CFIUS has been operating on a consensus basis for the past 
year. As such, any CFIUS member can bring a case to CFIUS for review as well as escalate a 
case for investigation. In addition, although the law requires CFIUS to provide reports to the 
Congress only on transactions that receive a presidential decision, Treasury officials informed us 
that, in the spirit of transparency, it now provides all final CFIUS results to the Congress. 
Therefore, our original concern about Treasury’s leadership of CFIUS—based on its competing 
interests—appears to be mitigated due to the recent increase of checks and balances on 
Treasury’s decision-making authority. 


Conclusion 


Even with the possible enactment of the pending CFIUS legislation, we still have concerns about 
the overall effectiveness of CFIUS’ monitoring of foreign investments for national security 
reasons. Specifically, whether or not it is determined to be feasible to require mandatory 
reporting to CFIUS, we are concerned that the committee may not be capturing acquisitions and 
mergers involving small or medium-sized U.S. companies that manufacture or conduct research 
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on sensitive U.S. technologies, as noted earlier in our report. Also, it is not clear whether 
companies that withdraw their filings at various stages in the process are adequately monitored 
by CFIUS to ensure that a merger or acquisition that raises potential national security concerns 
does not continue without further review. Additionally, there does not appear to be a formal 
mechanism in place to monitor mitigation agreements that CFIUS members enter into with 
parties to a merger or acquisition. 

Our March 2000 report suggested that an interagency OIG review of the CFIUS process, 
conducted by the OIGs from the Departments of Commerce, Defense and the Treasury, may be 
warranted, as a part of our responsibilities under the National Defense Authorization Act for 
Fiscal Year 2000, as amended. While the Inspectors General of Treasury and Defense concurred 
with our suggestion, other priorities prevented this review from taking place. Nevertheless, we 
still believe that such a review is warranted to (1) determine the scope of the problem regarding 
foreign investment in U.S. companies with sensitive technologies by countries and entities of 
concern and (2) review the overall effectiveness of CFIUS and recommend improvements, as 
necessary, to the way the U.S. government monitors foreign investment in these companies. 

B. Update on Closed OIG Recommendations Related to Commerce’s Role in CFIUS 

Placement of CFIUS Responsibility Within the Department —Update 

When CFIUS was created, the Department’s export control functions were performed by ITA. 
However, in 1987 the Congress decided to split the Department’s trade promotion 
responsibilities from its export control and enforcement functions. Thus, the Bureau of Export 
Administration (now BIS) was created as an independent Commerce bureau to handle the latter 
trade administration functions. While ITA’s focus remained on trade promotion, it also retained 
its role as Commerce’s representative on CFIUS. With the passage of the Exon-Florio provision 
in 1988, however, CFIUS’s main focus was shifted from monitoring overall foreign investment 
in the United States to determining the effects on national security of foreign mergers, 
acquisitions, and takeovers of U.S. companies. Given the main thrust of Exon-Florio is to 
prevent foreign acquisitions or investments that could threaten national security, our March 2000 
report questioned why the lead responsibility for CFIUS within the Department was with ITA 
and not BIS. 

In response to our March 2000 report, ITA stated that it should retain the role as the lead 
organization in Commerce on CFIUS issues. In addition, it stated that ITA would continue to 
encourage full involvement and cooperation by all concerned units in the Department and would 
participate fully in efforts to seek productive ways of improving the effectiveness of CFIUS. 

BIS’ response stated that the current Commerce mechanism for reviewing CFIUS filings is 
sufficient, but that it would accept the responsibility if it were transferred to it. 

We still believe that BIS may be the more appropriate entity to have the lead on CFIUS within 
Commerce given its national security mission. However, based on our discussions with BIS and 
ITA officials and our limited case reviews, it appears that the current Commerce process is 
working well. Both ITA and BIS report that disagreements between the two entities during 
Commerce’s decision-making process are rare. ITA officials attribute this, in part, to the fact 
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that it defers to BIS on any case that raises specific export control concerns. We only identified 
one case in which BIS and ITA officially disagreed, but the issues of concern did not involve 
export controls. Ultimately, the decision on Commerce’s position on this case was raised to the 
Deputy Secretary, who made the final decision. 

While we are encouraged by these recent developments, we are concerned that there are no 
comprehensive, written procedures outlining how the CFIUS process works in Commerce. The 
director of ITA’s Office of Competition and Economic Analysis (OCEA) informed us that he is 
planning on establishing written CFIUS guidelines in the next month and distributing them to 
BIS, NIST, and other offices within Commerce that work on CFIUS. We also were informed 
that, in March 2007, BIS developed written guidance for handling of the CFIUS process within 
BIS. It is now appropriate that ITA, BIS, and other relevant Commerce offices work together to 
develop and implement written procedures outlining how the CFIUS process should work in the 
Department, including the roles and responsibilities of all parties involved in the process. 

Recommendation: 


We recommend that ITA work with BIS and other relevant Commerce offices to establish 
written procedures outlining the specific CFIUS roles and responsibilities of Commerce units 
and how the CFIUS process should work in Commerce to ensure continued coordination and 
cooperation. 

BIS’ Internal Review of CFIUS Notifications —Update 

While our prior work found that the Office of Strategic Industries and Economic Security 
(OSIES) was conducting a fairly comprehensive review of CFIUS notifications in response to 
ITA’s referrals, our March 2000 report raised concerns that these notifications, and in particular 
those involving entities from countries of concern, were not always reviewed by Export 
Administration’s and Export Enforcement’s licensing and enforcement experts. However, based 
on our follow-up work, we found that OSIES has greatly increased its collaboration with these 
components of BIS. OSIES now works more closely with licensing officers on each CFIUS 
filing: Every notification is sent to the appropriate licensing officer for a technical review and to 
determine if applicable U.S. technologies and/or commodities involved in the transaction fall 
under the Export Administration Regulations. The division director of OSIES also reported that 
in order for licensing officers to better understand what CFIUS is and to ensure that applicable 
CFIUS transactions are not overlooked during the export licensing process, OSIES is providing 
training to licensing officers on the CFIUS process. 

In addition to working with licensing officers, OSIES is working more closely with export 
enforcement officials. Specifically, all parties associated with CFIUS filings are reportedly 
vetted with Export Enforcement to ensure that there are no export enforcement concerns relevant 
to a CFIUS case under review. We also found, based on two recent CFIUS cases we reviewed, 
that OSIES refers possible export control violations identified as a part of the CFIUS review 
process to Export Enforcement’s Office of Export Enforcement (OEE). Given the 30-day 
CFIUS review period, OEE made these referrals a priority and was able to respond back to 
OSIES in a timely fashion with the recommendation that these cases could move forward in the 


10 



U.S. Department of Commerce 
Office of Inspector General 


Final Report IPE-18546 
_ March 2007 


CFIUS process. Furthermore, it should be noted that OEE is planning to conduct outreach visits 
in 2007 with U.S. parties to CFIUS transactions to educate and inform them of their export 
control responsibilities. The director of OSIES informed us that he and/or his staff plan to 
accompany OEE on two of the outreach visits scheduled in April 2007. 

Additionally, as noted previously, BIS has recently established written procedures that reflect the 
new CFIUS process within the bureau. The director of OSIES told us that this document was 
distributed to every analyst who is involved with CFIUS. Also, the Assistant Secretary for 
Export Administration was recently briefed on the newly created CFIUS written procedures. 

Finally, it should be noted that in 2006 and 2007, Commerce, in particular BIS, along with 
several other CFIUS members, participated in negotiating two mitigation agreements with parties 
involved in sensitive acquisitions of U.S. companies. BIS will be responsible for monitoring the 
export control provisions of these agreements when they take effect in the near future. However, 
BIS does not have any written procedures in place that outline how it should monitor these 
provisions of the agreements. (As of March 30, 2007, the Director of OSIES told us that his 
office is currently working on a draft version of the procedures for monitoring provisions of the 
mitigation agreements.) To better ensure that mitigation agreements are adhered to by the parties 
involved, BIS should finalize and issue those procedures that will allow it to monitor and enforce 
the export control provisions of these agreements. 

Recommendation : 

We recommend that BIS finalize and implement written procedures that outline how it will 
monitor and enforce the dual-use export control provisions of mitigation agreements entered into 
by CFIUS. 
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400 Army Navy Drive (Room 801) 
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SUBJECT: Report on Followup Audit on Recommendations for Controls Over Exporting Sensitive 
Technologies to Countries of Concern (Report No. D-2007-XXX) 


We are providing this report for review and comment. We conducted the audit to comply with 
Public Law 106-65, “National Defense Authorization Act of Fiscal Year 2000,” Section 1402, “Annual 
Report on Transfers of Militarily Sensitive Technology to Countries and Entities of Concern.” 

DoD Directive 7650.3 requires that all recommendations be resolved promptly. We 
considered comments from the Under Secretary of Defense for Acquisition, Technology, and 
Logistics and from the Defense Technology Security Administration when preparing the final 
report. Because those comments did not provide concurrence or nonconcurrence with the 
recommendation, we request that those organizations send comments by October 29, 2007. We 
did not receive comments on a draft of this report from the Under Secretary of Defense for Policy 
or the Deputy Under Secretary of Defense for Technology Security Policy and National Disclosure 
Policy; we request that they provide comments by October 29, 2007. Although not requested, 

Defense Research and Engineering provided comments, We made minor changes to the report in 
response to comments, the complete text of which is in the Management Comments section. 

If possible, please send management comments in electronic format (Adobe Acrobat file only) to 
AudROS@dodig.mil . Copies of the management comments must contain the actual signature of the 
authorizing official. We cannot accept the / Signed / symbol in place of the actual signature. If you 
arrange to send classified comments electronically, they must be sent over the SECRET Internet Protocol 
Router Network (SIPRNET). 

We appreciate the courtesies extended to the staff. Questions should be directed to 
Mr. Dennis L. Conway (703) 604-9172 (DSN 664-9172) or Mr, Lamar Anderson at (703) 604-9640 
(DSN 664-9640). The team members are listed inside the back cover. See Appendix E for the report 
distribution, 


By direction of the Deputy Inspector General for Auditing: 



Assistant Inspector General 
Readiness and Operations Support 
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Followup Audit on Recommendations for Controls Over Exporting 
Sensitive Technologies to Countries of Concern 

Executive Summary 


Who Should Read This Report and Why? Personnel who are responsible for developing and 
implementing controls over exports of sensitive technology should read this report. It discusses 
audit recommendations to strengthen controls over exporting sensitive goods, services, and 
technologies to foreign countries and persons. 

Background. Public Law 106-65, “National Defense Authorization Act for Fiscal Year 2000,” 
requires the Inspectors General of the Departments of Commerce, Defense, Energy, and State to 
conduct annual reviews of the transfer of militarily sensitive technology to countries of concern. For 
the annual review due to Congress by March 30, 2007, these Inspectors General were joined by 
those of the Departments of Homeland Security, Treasury, the U.S. Postal Service, and the Central 
Intelligence Agency. The Inspectors General decided to follow up on recommendations made from 
FY 2000 through FY 2006 to improve controls over exports. Each year, the results of the individual 
agencies’ reviews are combined in a report to Congress. 

Results. The DoD Inspector General made 39 recommendations during FYs 2000 through 2006 to 
strengthen controls and reduce risks contributing to the inappropriate export of goods, services, and 
technologies such as chemicals, toxins, electronics, explosives, sensors, and lasers. As of June 28, 
2006, DoD organizations had implemented 25 of the 39 recommendations. During this audit, we 
found four additional recommendations were implemented for a total of 29 recommendations. 
Therefore, as of December 21, 2006, DoD organizations still needed to implement 10 
recommendations. The 10 remaining recommendations request DoD organizations to develop, 
implement, or revise guidance to determine whether an export license is required; to prevent 
unauthorized access to or disclosure of export-controlled technology; and to establish roles and 
responsibilities for persons involved with export-controlled technology. Also, the recommendations 
relate to analyzing and documenting analysis of export applications; updating export guidance to 
reflect current organizational titles, responsibilities, and structure; giving users access to the DoD 
export application system; and developing effective management controls. Until our recommended 
actions are implemented, DoD continues to accept avoidable risks of inappropriately exporting 
sensitive goods, services, and technology that could threaten our national security. (See the Finding 
section of the report for the detailed recommendations.) 

Management Comments and Audit Response. We issued a draft of this report on 
March 12, 2007. The Director of Defense Procurement and Acquisition Policy responded for the 
Under Secretary of Defense for Acquisition, Technology, and Logistics and neither concurred nor 
nonconcurred with our finding and recommendation. We considered the Director’s response related 
to explaining the process for revising the Defense Federal Acquisition Regulation Supplement; 
however, we did not see that an explanation of the process was needed to explain the status of our 
recommendation. We agreed with the Director’s comments and revised our report to state that the 
proposed changes in the Defense Federal Acquisition Regulation Supplement did not meet the intent 
of our prior recommendation. Also, we considered the Director’s comments and deleted our 
references to the Defense Federal Acquisition Regulation Supplement related to issuing guidance 
and training DoD personnel. We revised our finding to show that the draft policy issued by the 
Deputy Under Secretary of Defense for Technology Security Policy and National Disclosure Policy 



should address our recommendation for issuing guidance and training DoD personnel on procedures 
for handling exports, if approved and implemented. In addition, we considered and revised our 
report to reflect the Director’s comments concerning the responsibility of the Under Secretary of 
Defense for Policy for revising and issuing draft DoD Instruction 2040.2. We made no change in 
response to the Director’s comment that no DoD Instruction is numbered 2040.2. A draft of the new 
DoD Instruction 2040.2 is being coordinated within the Department; this Instruction will replace 
DoD Directive 2040.2. Finally, we considered the Director’s comments that his office’s procedures 
for following up on our recommendation was timely and adequate. However, more timely action by 
the Director’s office is needed to implement our recommendation. We issued our audit report on 
March 25, 2004, and one recommendation remained outstanding on March 29, 2007. Until changes 
are made, DoD will be at increased risk of other nations’ countering or reproducing our technology. 
We request that management provide comments on this final report by October 29, 2007. 

The Director (Acting) of the Defense Technology Security Administration nonconcurred with our 
findings related to her office. Specifically, the Director disagreed with our use of the policies in the 
Export Administration Regulations for evaluating her office’s review of applications to export dual- 
use items. However, we used those export policies and procedures for evaluating the review of 
license applications after reviewing and considering DoD’s directive on management controls. That 
directive requires organizations to perform functions to comply with applicable laws and 
management policy. The Export Administration Act is the law that establishes the requirements for 
processing export license applications and the Export Administration Regulations implement the 
management policies for processing those applications. DoD should consider those policies in 
making recommendations to the Department of Commerce on export license applications. Also, the 
Director disagreed with our finding that her office was required to document reasons for all 
recommendations made on export applications. We addressed the need to document reasons for all 
recommendations in our prior report, “Controls Over Exports to China,” March 30, 2006. That 
report cited the Principal Statutory Authority for the Export Administration Regulations, which 
stated that DoD will make and keep records of its advice, recommendations, or decisions, including 
the factual and analytical basis, connected with export licenses. We agree with the Director’s 
comment that her office had no statutory or regulatory authority to approve or deny export 
applications, merely to recommend a course of action to the licensing department. We modified our 
report to show that her office was only responsible for making recommendations to the Department 
of Commerce. Further, we considered and agreed with the Director’s comment that DoD Instruction 
2040.2 cannot be finalized until it has been coordinated with DoD activities and completed by the 
Under Secretary of Defense for Policy. We request that management provide comments on this final 
report by October 29, 2007. 

We did not receive any written management comments on this report from the Under Secretary of 
Defense for Policy or from the Deputy Under Secretary of Defense for Technology Security Policy 
and National Disclosure Policy. Therefore, we request that both provide management comments 
on this final report by October 29, 2007. Although no comments were required, we received and 
agreed with comments provided by the Director of Defense Laboratory Programs, who responded 
for the Director, Defense Research and Engineering. The Director commented that our 
recommendation to complete DoD Instruction 2040.2 should be redirected to the Under Secretary 
of Defense for Policy; we did so in the draft. Also, the Director asked us to consider revising the 
report to state that DoD Instruction 2040.2 will provide export procedures, the Defense Federal 
Acquisition Regulation Supplement will provide specific clauses concerning export procedures, 
and training on export compliance requirements depend on the content of the yet-to-be-published 
Defense Federal Acquisition Regulation Supplement and DoD Instruction 2040.2. See the 
Findings section for a discussion of management comments, and see the Management Comments 
section for the complete text of the comments. 


ii 
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Background 


Annual Review on Transfers of Technology. In FY 2000, Congress passed 
Public Law 106-65, 1 which requires an annual review of transfers of sensitive 
technology to countries of concern. The law required annual reviews to begin in 
FY 2000 and end in FY 2007. To comply with the law, Inspectors General of 
affected departments and agencies formed an interagency team to conduct the 
reviews and produce the annual reports. 

Annual Report to Congress. For the annual report due to Congress by 
March 30, 2007, the Inspectors General decided to review whether 
recommendations made in previous reports had been implemented. The 
Inspectors General participating in this year’s review include those from the 
Departments of Commerce, Defense, Energy, Homeland Security, State, and 
Treasury; the U.S. Postal Service; and the Central Intelligence Agency. This 
audit report provides the legislatively required 2007 review of DoD controls over 
exports. 

Legislative Controls Over Exports. Several laws give the U.S. Government 
authority to control the export of commodities and technologies. The primary 
legislative authority for controlling the export of goods and technologies that have 
both civilian and military use (dual use) is the Export Administration Act of 
1979, as amended (title 50, United States Code, section 2401). 2 The Arms Export 
Control Act (title 22, United States Code, section 2778) authorizes the President 
to issue regulations for export of selected: 

• defense-related articles (which are models, mockups, or technical data 
shown on the U.S. Munitions List); 

• services, such as assistance provided to foreign persons in the design, 
development, and production of defense articles; and 

• technical data including either classified or unclassified information, 
other than software, required for the design, development, or production 
of defense articles. 


1 We performed this audit to comply with Public Law 106-65, “National Defense Authorization Act for 
Fiscal Year 2000,” section 1402, “Annual Report on Transfers of Militarily Sensitive Technology to 
Countries and Entities of Concern,” October 5, 1999. 

2 The Export Administration Act expired in August 1994. However, the President, under the authority of 
the International Emergency Economic Powers Act (50 U.S.C. 1702), continued the provision of the 
Export Administration Act through Executive Orders 12924 and 13222, “Continuation of Export Control 
Regulations,” August 19, 1994, and August 17, 2001, respectively. Each year thereafter, and most 
recently on August 3, 2006, the President issued a notice, “Continuation of Emergency Regarding Export 
Control Regulations,” extending Executive Order 13222. 
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DoD Export Control Responsibilities. DoD designated the following offices to 
develop and implement export control policy and to control exports to foreign 
countries and persons: 


• Under Secretary of Defense for Acquisition, Technology, and Logistics 
(USD[AT&L]). The USD(AT&L), in coordination with the Under 
Secretary of Defense for Policy, is responsible for providing technology 
assessments that help DoD determine the national security implications of 
the transfer of technology, goods, services, and munitions. 3 Also, the 
USD(AT&L) advises the Under Secretary of Defense for Policy on the 
technological aspects of export control policies and procedures necessary 
to protect the national security interests of the United States. 

• Under Secretary of Defense for Policy (USD[P]). The USD(P) is 
responsible for the formulation of defense policy and for the integration 
and oversight of DoD policies and plans to achieve national security 
objectives. Specifically, the USD(P) oversees all aspects of DoD transfers 
of international technology, including export controls, licensing of dual- 
use commodities 4 and munitions, and arms cooperation programs. As part 
of its oversight responsibilities, the USD(P) supervises the Office of the 
Deputy Under Secretary of Defense for Technology Security Policy and 
National Disclosure Policy. 

• Deputy Under Secretary of Defense for Technology Security Policy 
and National Disclosure Policy (DUSD[TSP&NDP]). The DUSD 
(TSP&NDP) is responsible for developing and implementing DoD 
technology security policies to control defense-related goods, services, and 
technology exports. The DUSD(TSP&NDP) also serves as the Director of 
the Defense Technology Security Administration (DTSA), responsible for 
coordinating reviews of license applications and reporting decisions made 
on the basis of those reviews to the Department of Commerce. 


Objectives 


The overall objective of this audit was to determine whether DoD effectively 
implemented recommendations made by the DoD Office of Inspector General in 
our seven previous reports (FY 2000 to FY 2006) on controls over militarily 
sensitive exports. Management had implemented recommendations from four of 
the seven reports; therefore, we reviewed the three remaining reports to determine 
management action. Specifically, we evaluated management actions taken on: 

• all recommendations contained in DoD IG Report No. D-2006-067, 
“Controls Over Exports to China,” March 30, 2006; 


3 Munitions include arms and ammunition as well as any material, equipment, or goods used to make 
military items. 

4 Dual-use commodities can be used for commercial or military purposes. 
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• Recommendations 1. and 2. in DoD IG Report No. D-2004-061, “Export- 
Controlled Technology at Contractor, University, and Federally Funded 
Research and Development Center Facilities,” March 25, 2004; and 

• Recommendations A. 1. and A.2. in DoD IG Report No. D-2000-110, 
“Export Licensing at DoD Research Facilities,” March 24, 2000, which 
related to controls over exporting sensitive technologies to countries of 
concern. 

See Appendix A for a discussion of the scope and methodology, and Appendix B 
for prior coverage related to the audit objective. 
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Extent of Implementation of 
Recommendations To Improve Export 
Controls 

DoD organizations implemented 29 of 39 (74 percent) of the 
recommendations made in the 7 reports that we issued from FY 2000 
through FY 2006. We made the 39 recommendations to strengthen 
controls and reduce risks of inappropriate exports of goods, services, and 
technologies such as chemicals, toxins, electronics, explosives, sensors, 
and lasers. However, DoD organizations need to take further actions to 
fully implement the 10 remaining recommendations in 3 of the 7 reports. 

DoD organizations did not establish a fully effective process for following 
up and aggressively implementing the 10 outstanding recommendations as 
demonstrated by one recommendation that was not implemented for 
almost 7 years. Until recommended controls are implemented, DoD 
continues to accept avoidable risks of inappropriately exporting sensitive 
goods, services, and technology that could threaten our national security. 

DoD Guidance on Implementing Audit Recommendations 

Guidance on Implementing Recommendations. DoD Directive 7650.3, 
“Follow-up on General Accounting Office (GAO), 5 DoD Inspector General (DoD 
IG), and Internal Audit Reports,” provides guidance to DoD managers on 
implementing audit recommendations. The Directive states: 

• “The DoD Component managers recognize, support, and use auditors as 
important elements of DoD management systems. 

• Timely decisions and responsive actions shall be taken and documented on 
audit findings and recommendations to reduce costs, manage risks, and 
improve management processes. 

• Follow-up is an integral part of good management and is a responsibility 
shared by DoD managers and auditors. 

• An effective, credible decision process shall be maintained to resolve 
disputes on audit findings and recommendations; prevent preemptive 
actions, such as proceeding with activities questioned in undecided audit 
reports; and provide prompt and well-documented decisions consistent 
with statutes and regulations. 

• Follow-up systems shall provide for a complete record of action taken on 
findings and recommendations.” 


5 The General Accounting Office was renamed the Government Accountability Office. 
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Status of Recommendations. We announced the audit on June 28, 2006, to 
determine whether DoD officials had implemented the recommendations we 
made from FY 2000 through FY 2006. The results of this audit will be combined 
with the results of reviews by seven other Inspectors General in a report to 
Congress. The report will provide an assessment of the extent to which export 
controls were implemented within the Federal Government from FYs 2000 
through 2006. 

As of June 28, 2006, DoD organizations had implemented 25 of 39 (64 percent) 
of the recommendations made in our reports from FYs 2000 through 2006. Those 
DoD organizations had agreed to implement all 39 recommendations. 

During this audit, we found that DoD organizations had implemented four 
additional recommendations. Therefore, as of December 21, 2006, 29 of 39 
(74 percent) of the recommendations were implemented. The table shows the 
number of recommendations we made and those implemented by DoD 
organizations. 

Status of Recommendations 

Implemented 
As of As of 

June 28, Dec. 12, 


Number of 2006 2006 


Report Number 

Recommendations 

Yes 

No 

Yes 

No 

D-2006-067 

7 

0 

7 

1 

6 

D-2005-042 

1 

1 

0 

1 

0 

D-2004-061 

4 

1 

3 

1 

3 

D-2003-070 

3 

3 

0 

3 

0 

D-2002-039 

4 

4 

0 

4 

0 

D-2001-088 

8 

8 

0 

8 

0 

D-2000-110 

12 

8 

4 

11 

1 

Total 

39 

25 

14 

29 

10 


(See Appendix C for a complete list of the recommendations we reviewed.) 
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Work Needed To Implement Recommendations 


As of June 28, 2006, DoD organizations still needed to implement 14 of the 
recommendations made during FYs 2000 to 2006. 6 One outstanding 
recommendation was almost 7 years old. Also, as of December 12, 2006, we 
found that 4 additional recommendations were implemented, which resulted in 
10 remaining outstanding. 

Five DoD organizations were responsible for implementing the 
14 recommendations. We indicate responsibility for and discuss the status 
(outstanding or closed) of recommendations below, by organization: 

• Under Secretary of Defense for Acquisition, Technology, and Logistics 
(USD[AT&L]) was responsible for implementing 1 of the 

14 recommendations, this recommendation remains outstanding; 

• Under Secretary of Defense for Policy (USD[P]) was responsible for 
implementing 2 of the 14 recommendations, 1 of the 

2 recommendations remains outstanding; 

• Deputy Under Secretary of Defense for Technology Security Policy 
and National Disclosure Policy (DUSD[TSP&NDP]) was responsible 
for implementing 4 of the 14 recommendations, each of the 

4 recommendations remain outstanding; 

• Director, Defense Research and Engineering (DDR&E) was both 
responsible for implementing 2 of the 14 recommendations, 
recommendations were closed and a new recommendation was made 
in this report to USD(P); and 

• Director, Defense Technology Security Administration (DTSA) was 
responsible for implementing 5 of the 14 recommendations, 4 of the 

5 recommendations remain outstanding. 

Under Secretary of Defense for Acquisition, Technology, and 
Logistics (USDfAT&L]). The USD(AT&L) did not implement one of the 
recommendations in Report No. D-2004-061, “Export Controlled Technology at 
Contractor, University, and Federally Funded Research and Development Center 
Facilities.” We issued the report on March 25, 2004, and recommended that the 
USD(AT&L) develop and insert a clause in the Defense Federal Acquisition 
Regulation Supplement (DFARS) requiring contractors to: 

Comply with Federal export regulations and DoD guidance for export- 
controlled technology and technical data by obtaining an export license, 
other authorized approval or exemption, and preventing unauthorized 
disclosure to foreign nationals. 


6 As previously noted, we determined during this audit that 4 of the 14 recommendations were implemented, 
as of December 12, 2006. 
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Incorporate the terms of the clause in all subcontracts that involve 
export-controlled technology. 


Conduct initial and periodic training on export compliance controls for 
those employees who have access to export-controlled technology. 

Perform periodic self-assessments to ensure compliance with Federal 
export laws and regulations. 

Although the USD(AT&L) concurred with our recommendation in July 2004, the 
office had not implemented it as of December 21, 2006. However, USD(AT&L) 
did publish a draft of the proposed clause in the Federal Register dated 
August 14, 2006. USD(AT&L) officials stated that they received comments from 
the public in November 2006. However, as of February 5, 2007, USD(AT&L) 
had not completed the clause in the DFARS because those officials had not 
obtained the agreement from the Defense Acquisition Regulatory Council on the 
wording of the clause or the approval of the Office of Management and Budget’s 
Office of Information and Regulatory Affairs. 

We examined the proposed clause; it did not require contractors to conduct initial 
and periodic training or to perform periodic self-assessments on compliance with 
the Federal export laws and regulations. Therefore, we concluded that the clause 
did not meet the intent of the recommendation, which will remain outstanding 
(open) until the clause is revised to address the requirements of the 
recommendation and is published in the DFARS. 

Under Secretary of Defense for Policy (USD[P]). The Office of 
the USD(P) implemented one of the two recommendations we made in Report 
No. D-2000-110, “Export Licensing at DoD Research Facilities,” on March 24, 
2000. 

Specifically, we recommended that the USD(P): 

Coordinate with Commerce and State to develop guidance regarding 
when a visit or assignment of a foreign national to a Defense facility 
requires a deemed export license. 7 

Revise DoD Directive 2040.2, “International Transfers of Technology, 

Goods, Services, and Munitions,” to clearly state policies, procedures, 
and responsibilities of DoD and Military Department hosts for 
determining whether a deemed export license is required when a 
foreign national visits a Defense facility. 

Guidance on When To Obtain a Deemed Export License. On March 
24, 2000, the USD(P) agreed with the first recommendation to coordinate with the 
Departments of Commerce and State to develop guidance for when a visit or 
assignment of a foreign national to a DoD facility requires a deemed export 


7 A deemed export is defined by Export Administration Regulations (EAR) as a release of technology to 
foreign national in the United States through such means as visual inspection, oral exchanges, or 
application of personal knowledge or technical experience acquired in the United States. 
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license. Also, on March 24, 2000, the USD(P) stated that DoD Directive 5230.20, 
“Visits, Assignments, and Exchanges of Foreign Nationals,” would be revised to 
include DoD policies for licenses of deemed exports. During this audit, we 
examined the revised directive and determined that it includes guidance that 
satisfies our recommendation; therefore, we consider the recommendation closed. 

Revision of DoD Directive. For the second recommendation—to revise 
guidance by clearly stating how Departmental hosts 8 should determine whether a 
deemed export license is required when a foreign national visits a Defense 
facility—DoD took several actions. Specifically, DTSA, an office under the 
USD(P): 

• issued guidance in November 2002 and June 2003 that restricted the 
access of foreign nationals to export-controlled technologies at DoD 
facilities, and 

• continued to review DoD Directive 2040.2, “International Transfers of 
Technology, Goods, Services, and Munitions,” 9 as of February 2005. 

During this audit, a DUSD(TSP&NDP) official assigned to the USD(P) provided 
a draft memorandum, “Interim Guidance on Export Controls for Biological 
Agents,” dated August 14, 2004. We determined that the proposed memorandum 
would fulfill our recommendation and clearly defines the policies, procedures, 
and responsibilities of DoD and Military Department hosts for determining 
whether a deemed export license is required when a foreign national visits a DoD 
facility. A USD(P) official stated that the guidance will be included in the revised 
DoD Instruction 2040.2; however, the Instruction remains in draft, and the 
USD(P) official could not provide an estimated completion date. Therefore, this 
recommendation remains open until the guidance is published in DoD Instruction 
2040.2. 

Deputy Under Secretary of Defense for Technology Security 
Policy and National Disclosure Policy (DUSD[TSF&NDP]). 

DUSD(TSP&NDP) 10 did not implement two recommendations from FY 2004 and 
the two from FY 2006. In FY 2004, we issued Report No. D-2004-061, “Export 
Controlled Technology at Contractor, University, and Federally Funded Research 
and Development Center Facilities.” We issued the report on March 25, 2004, 
and recommended that the DUSD(TSP&NDP): 

Expand “Interim Guidance on Export Controls for Biological Agents,” 

November 7, 2002 to: 

Encompass all export-controlled technology. 


8 A host is a designated individual or organization that is responsible for coordinating foreign national visits 
to sensitive and nonsensitive U.S. Government facilities. 

9 DoD Directive 2040.2, “International Transfers of Technology, Goods, Services, and Munitions,” is now 
in draft as DoD Instruction 2040.2, “International Transfers of Technology, Goods, and Services.” 

10 DUSD(TSP&NDP) was formerly titled the Deputy Under Secretary of Defense for Technology Security 
Policy and Counter Proliferation. 




Require program managers, in coordination with counterintelligence, 
security, and foreign disclosure personnel to: 


• identify export-controlled technology, foreign national 
restrictions, and licensing requirements. 

• identify threats by foreign countries that are targeting the 
specific technologies. 

• identify vulnerabilities and countermeasures to protect the 
export-controlled technology. 

Require program managers and contracting officers to ensure that 
contracts identify the export-controlled technology and contain 
requirements to maintain an access control plan, including unique 
badging technology; perform export compliance training; conduct 
annual self-assessments; and comply with Federal export laws by 
obtaining an export license, other authorized approval or exemption, or 
by safeguarding the technology when contracts involve export- 
controlled technology or information. 

Expanding Interim Guidance. The DUSD(TSP&NDP) generally concurred 
with this recommendation on February 17, 2004, and later stated that follow-on 
draft guidance was issued in August 2004. We examined the draft interim 
guidance and found the guidance did address a portion of the recommendation; 
however, the guidance did not include procedures that require program managers, 
in coordination with counterintelligence, security, and foreign disclosure 
personnel, to identify: 

• export-controlled technology, foreign national restrictions, and licensing 
requirements; 

• threats by foreign countries that are targeting the specific technologies; 
and 

• vulnerabilities and countermeasures to protect the export-controlled 
technology. 

In addition, the interim guidance was not expanded to require program managers 
and contracting officers to conduct annual self-assessments. 

On January 17, 2007, a DUSD(TSP&NDP) official stated that his office was 
working to include these procedures in the draft interim guidance. On February 2, 
2007, a DUSD(TSP&NDP) official told us that the draft interim guidance will not 
be issued as a separate memorandum because the guidance will be published in 
DoD Instruction 2040.2. However, our recommendation was not incorporated in 
either the interim guidance or the Instruction; therefore, we consider this 
recommendation open. Further, in this report, we issued a new recommendation 
that requests the USD(P) to complete and publish DoD Instruction 2040.2, 
because the USD(P) has the responsibility for updating and publishing this 
Instruction. 
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Incorporating Interim Guidance in a DoD Directive. For the second 
recommendation, we requested the DUSD(TSP&NDP): 

Incorporate the interim guidance into the revision of DoD Directive 
2040.2, “International Transfers of Technology, Goods, Services, and 
Munitions,” January 1984, to include the roles and responsibilities of 
the program managers, counterintelligence, security, and foreign 
disclosure personnel. 

The DUSD(TSP&NDP) generally concurred with this recommendation on 
March 25, 2004, and planned to include the interim guidance in DoD 
Instruction 2040.2. In August 2004, the DUSD(TSP&NDP) issued interim 
guidance. 

During this audit, we reviewed the interim guidance and the DoD Instruction; 
neither addressed the roles and responsibilities of counterintelligence and foreign 
disclosure personnel for controlling the release of technology and technical data. 
Also during the audit, a DUSD(TSP&NDP) official reiterated to us on February 2, 
2007, that the interim guidance will not be re-issued as a separate memorandum 
because the guidance will be published in the revised DoD Instruction. 

Regardless, the DoD Instruction did not fully address our recommendation and 
remains in draft without a planned completion date. Therefore, this 
recommendation remains open. 

Gaining Access to USXPORTS. In addition to the recommendations we 
made in FY 2004 to the USD(TSP&NDP), we examined the following two 
recommendations addressed to the USD(TSP&NDP) in Report No. D-2006-067, 
“Controls Over Exports to China.” Specifically, we recommended on March 30, 
2006, that the DUSD(TSP&NDP): 

Grant access privileges to the four DoD organizations currently without 
access to USXPORTS to facilitate reviews of export applications. 

Update the guidance for the export review process to reflect current 
organizations and responsibilities. 

Audit Report No. D-2006-067 identified that 4 of the 18 DoD organizations 
responsible for reviewing export applications were disconnected from 
USXPORTS (USXPORTS is an automated system used by DoD to process 
electronic export license data). The audit report recommended that the four 
organizations’ access to this system be restored. The DUSD(TSP&NDP) agreed 
with our recommendation on March 29, 2006, and stated she would inform users 
of USXPORTS, within 60 days of becoming disconnected from the system, of the 
need to maintain access. 

As of December 21, 2006, we found that DUSD(TSP&NDP) did not inform the 
four organizations’ users of the need to maintain access to USXPORTS. A DTSA 
official, who reports to the Office of the DUSD(TSP&NDP), suggested we 
coordinate with the USD(P) regarding users’ access to USXPORTS. (The 
USD[P] is responsible for developing, maintaining, and operating USXPORTS.) 
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We asked a USD(P) official why users at the four organizations were not 
informed of the need to maintain access to USXPORTS. The USD(P) official 
was unable to provide a reason. He told us that his office did not coordinate with 
DTSA when users were dropped from USXPORTS. Therefore, DTSA would not 
have known when users of USXPORTS were dropped from the system. 

As a result of our discussions with the USD(P) official, we again asked the DTSA 
official why users of USXPORTS were not notified of the need to maintain access 
to USXPORTS. The DTSA official told us that the organizations were notified, 
but he could not provide documentation to show that they were notified. Also, the 
DTSA official told us that DTSA could not require organizations to use 
USXPORTS. In addition, the DTSA official stated that there were plans to 
transfer responsibility for USXPORTS from USD(P) to DTSA; however, he could 
not provide the date of transfer. Although the DTSA official could not provide a 
date when DTSA would assume the responsibilities for USXPORTS, he told us 
that when the transfer occurs his office will modify DoD Instruction 2040.2 to 
require users of USXPORTS to maintain access to USXPORTS. As a result, the 
recommendation remains open. 

Updating Guidance on the Export Review Process. Our second 
recommendation asked DUSD(TSP&NDP) to update guidance on the export 
review process to reflect current organizations and responsibilities. 
DUSD(TSP&NDP) agreed with this recommendation on March 29, 2006, and 
stated that organizational changes would be accurately reflected in the guidance 
on the export review process. 

We determined that DUSD(TSP&NDP) established draft guidance, but the 
guidance was not updated to reflect current DoD organizations and 
responsibilities. On November 14, 2006, a DUSD(TSP&NDP) official stated that 
the guidance is a draft and the current organizations and responsibilities cannot be 
completely determined until the Office of the Secretary of Defense completes its 
reorganization. As a result, the recommendation remains open. 

Director, Defense Research and Engineering (DDR&E). The 

following two recommendations to DDR&E are in Report No. D-2000-110, 
“Export Licensing at DoD Research Facilities,” March 24, 2000. 

Develop an export control program document containing procedures 
for determining if technology or commodities at Defense research 
facilities can be exported, with or without a license, including 
circumstances that may constitute exemptions from requirements of the 
Export Administration Regulations or International Traffic in Arms 
Regulations. 

Mandate training requirements for personnel at Defense research 
facilities on the deemed export licensing requirements of the Export 
Administration Regulations and International Traffic in Arms 
Regulations. 
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Guidance on Restricted Technology. DDR&E officials stated that the 
DUSD(TSP&NDP) issued a memorandum on August 14, 2004, that included a 
revised draft policy memorandum and a guide, “Managing Foreign Access: 
Implementing DoD Guidance on Restricted Technology.” During this audit, we 
found the guide contained procedures for determining whether goods, services, 
and technology at DoD research facilities were exportable with or without a 
license. In addition, we determined that this guidance is in draft and will be 
included in DoD Instruction 2040.2, which will be completed by USD(P) because 
the USD(P) has the responsibility for updating and publishing this Instruction. 
Therefore, we decided to close our recommendation to the DDR&E and issue a 
new recommendation requesting that USD(P) complete and publish DoD 
Instruction 2040.2. The new recommendation requests that USD(P) merge 
procedures for determining whether goods, services, and technology at DoD 
research facilities were exportable with or without a license—procedures already 
contained in the draft policy guide, “Managing Foreign Access: Implementing 
DoD Guidance on Restricted Technology”—into the DoD Instruction. 

Training Requirements for Defense Research Personnel. For the 

second recommendation, a DDR&E official informed us that the training 
requirements for personnel at DoD research facilities depend on the content of 
yet-to-be-published revisions of the DFARS and DoD Instruction 2040.2. In 
addition, DDR&E officials told us that they trained program managers, laboratory 
personnel, and security managers on deemed export licensing requirements of the 
Export Administration Regulations and the International Traffic in Arms 
Regulations. 

Our review of the proposed revisions to DFARS and DoD Instruction 2040.2 
determined that neither document included a mandate for training personnel at 
DoD research facilities on deemed export licensing requirements. As previously 
stated, DDR&E officials stated that the DUSD(TSP&NDP) issued a 
memorandum on August 14, 2004, that included a revised draft policy 
memorandum and a guide, “Managing Foreign Access: Implementing DoD 
Guidance on Restricted Technology.” 

We found the guide prescribed training for personnel at DoD research facilities on 
export licensing requirements. However, on February 2, 2007, a 
DUSD(TSP&NDP) official reiterated to us that the interim guidance will not be 
issued as a separate memorandum because the guidance will be published in DoD 
Instruction 2040.2. As such, our recommendation was not included in the 
pending revisions to the DFARS and the Instruction. 

Further, we issued a new recommendation that requests the USD(P) to complete 
and publish DoD Instruction 2040.2 because, as previously stated, the USD(P) has 
the responsibility for updating and publishing this Instruction. Therefore, we 
decided to close our recommendation to DDR&E and issue a new 
recommendation that requests USD(P) to complete and publish the DoD 
Instruction. Completing the Instruction will involve the insertion of a mandate 
contained in the draft policy guide, “Managing Foreign Access: Implementing 
DoD Guidance on Restricted Technology” for training personnel at DoD research 
facilities on deemed export licensing requirements. 
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Director, Defense Technology Security Administration 
(DTSA). The DTSA implemented one recommendation but not four others 
made in Report No. D-2006-067, “Controls Over Exports to China,” 

March 30, 2006. During this audit, we examined DTSA actions to implement the 
following five recommendations: 

Prepare written analyses to support decisions on export applications 
and maintain documents in USXPORTS to support those decisions. 

Elevate decisions to the extent possible when the appeal process does 
not produce a decision that supports the national security posture. 

Provide written responsibilities to the senior management control 
official for administering the management control program. 

Maintain documentation of training that managers of operating and 
assessable units receive. 

Adjust the internal management control program to more effectively 
assess internal controls for recording analyses and documentation in 
USXPORTS. 

Documentation for Decisions on Export Applications. In response to 
the first recommendation, on May 19, 2006, the Acting DUSD(TSP&NDP) 
replied for DTSA: 

We are in general agreement with the proposition that complete 
analysis is a necessary and vital part of the licensing process. 

However, we disagree that inclusion of every facet of analysis 
considered in making a licensing determination is required-or even 
necessary-in every individual case. This is particularly true since 
implementation of a newer, automated license system, USXPORTS. 

All cases that were reviewed for this Report occurred prior to 
USXPORTS deployment. Significant changes have been made to the 
automated license database including: 

• USXPORTS maintains thorough data for each case, e.g., 
support documents, technical specification, end-user 
information, etc; 

• USXPORTS provides an easy way for licensing experts to 
search for precedent decisions, e.g., cases that involve the 
same item to the same destination, or the same end user or 
an item of similar capability to the same country; and 

• USXPORTS now contains complete analytic information 
for all cases escalated to the Operating Committee, the 
interagency committee that is the first line of escalation for 
disputed cases and where most are resolved. 
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To determine whether the recommendation was implemented, we requested and 
received the files supporting 1,609 and 1,880 applications to export to China for 
calendar years 2005 and 2006, respectively. We found that DTSA made 
recommendations (with conditions) to approve 2,953 export applications and to 
disapprove 385 applications. Those 3,338 applications represented 96 percent of 
the 3,489 applications processed for exports to China in calendar years 2005 and 
2006. 11 According to DTSA officials, the 3,489 applications contained complete 
and timely data. 

Selection Process for Application Review. We judgmentally 
selected and reviewed 40 of the 3,489 applications that contained requests to 
export sensitive goods, services, and technology such as chemicals and toxins, 
electronics, explosives, sensors, and lasers. The sample of 40 applications had 
closing dates 12 from January 7, 2005, to December 29, 2006. We selected these 
applications because of the potential adverse impact the prospective exports 
would have on regional stability, proliferation of nuclear weapons, use of 
chemical and biological weapons, and national security, if sent to China. 

Results of Application Review. The review of the application 
files showed that 29 of the 40 files did not contain adequate analysis. In addition, 
39 of the 40 did not have adequate supporting documentation. 

For example, one file contained an application that recommended approval 
with conditions to export a pulse neutron generator to China. For this item, the 
Export Administration Regulations state that eight factors should be considered 
when determining whether to recommend approval of an application. Those 
factors were: 

• whether the items to be transferred are appropriate for the stated end use 
and whether that stated end use is appropriate for the end user, 

• the significance for nuclear purposes of the particular item, 

• whether the item can be used in a nuclear reprocessing or enrichment 
facility, 

• the types of assurances given that the item will not be used for nuclear 
explosive purposes or proliferation, 

• whether any party to the transaction has been engaged in clandestine or 
illegal procurement activities, 

• whether an application has previously been denied, or whether the end 
user has previously diverted items, 


11 The remaining applications were either approved, returned to the applicant without action, or partially 
approved. 

12 DTSA defined “closing date” as the date when it completed work on an application, developed its final 
recommendation for the application, and returned the application to the Department of Commerce. 
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• whether the export or re-export would present an unacceptable risk of 
diversion to a nuclear explosive activity or a nuclear fuel-cycle activity, 
and 

• the nonproliferation credential of the importing country. 

A review of this application file determined that the analysis and documentation 
were inadequate to justify the decision made by DTSA to recommend approval of 
this application. Specifically, the file did not include adequate analysis or 
documentation for any of the eight factors. Therefore, the file did not support the 
recommendation to approve the application. Because 29 of 40 files did not 
contain adequate analysis and 39 of 40 lacked documentation, our 
recommendation remains open. See Appendix D for the results of our analysis of 
the 40 application files we selected for review. 

Decisions To Elevate Recommendations. For our second 
recommendation, we suggested that DTSA elevate its recommendations to the 
extent possible in the export application appeal process, if the majority of the 
representatives from the Departments of Commerce, Energy, and State did not 
agree with a DTSA recommendation (DTSA is responsible for recommending 
whether to approve export applications for DoD). We selected 11 applications 
that DTSA disapproved. One of the 11 was approved (with conditions) by all the 
other Departmental representatives. Thus, the majority of the Departments 
opposed the DTSA recommendation. Therefore, DTSA had the opportunity to 
appeal, but instead changed its recommendation and decided to approve the 
application with conditions. 

Export Administration Regulations do not require a Department to appeal if the 
majority of the other Departments disagree with its recommendation. Also, 
Export Administration Regulations allow a Department to add conditions that it 
considers appropriate to offset the risk associated with approval of an application. 
As a result, our sample did not detect any instances in which DTSA did not use 
the appeal process to the extent it considered possible. Therefore, we consider 
this recommendation closed. 

Management Control Plan. For the remaining three recommendations, 
which pertain to management controls, DTSA agreed with the recommendations 
on March 29, 2006, and stated it had adjusted its management control plan to: 

• provide written responsibilities to the senior management control 
official, 

• maintain training documentation for managers of operating and 
assessable units, and 

• more effectively assess internal controls for recording analyses and 
maintaining documentation in USXPORTS. 

DTSA provided a draft management control plan that did not meet the intent of 
the recommendations. On November 16, 2006, a DTSA official stated that 
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controls were in place but not written into the draft management control plan 
because of significant personnel turnover. Although he stated that the plan would 
be updated by December 31, 2006, we were unable to obtain this plan before we 
completed the audit. The three recommendations cited above will remain open 
until DTSA updates and approves the management control plan, including the 
requirements of our recommendations. 

Effective Process for Following Up on Prior Recommendations 


While the five DoD organizations responsible for managing export activities 
implemented most of the recommendations, they did not establish a fully effective 
process for following up on and implementing all of our recommendations. 

Those organizations had agreed to implement each of our 39 recommendations; 
however, 1 recommendation remained open for almost 7 years. 

DoD Instruction 5010.40, “Managers’ Internal Control (MIC) Program 
Procedures,” January 4, 2006, states that the Managers’ Internal Control Program 
should identify and promptly correct ineffective internal controls. Also, the 
Instruction requires DoD managers to track corrective actions taken to expedite 
prompt resolution of control deficiencies. In addition, the Instruction states that 
the deficiencies identified, whether through internal review or by an external 
audit, should be evaluated and corrected. 

Office of Management and Budget Circular No. A-123, “Management’s 
Responsibility for Internal Control,” December 21, 2004, requires DoD 
Component managers to take prompt and effective actions to correct weaknesses 
in their internal control processes. The Circular states that management must 
make a decision regarding Inspector General audit recommendations within a 
6-month period and complete implementation of management’s decision within 
1 year, to the extent practicable. 

The audit showed that four DoD organizations were not prompt in implementing 
10 of the recommendations. While DoD organizations made improvements in 
export controls and implemented 74 percent of the recommendations, they told us 
that implementation of the remaining recommendations was restricted, in part, by 
the ongoing DoD reorganization, personnel turnover, insufficient numbers of 
personnel, and the formal process for updating the DFARS. However, we 
contend that DoD managers are constantly confronted with constraints on 
resources and with organizational changes and must take action to implement 
audit recommendations to manage risks and improve management processes. 

Risks of Not Implementing Export Controls 

Until the recommended controls are implemented, DoD continues to accept 
avoidable risks of exporting sensitive goods, services, and technology that could 
threaten our national security. During this audit, we found that 
10 recommendations remain open. We made 1 of the 10 recommendations in 
FY 2000, 3 in FY 2004, and 6 in FY 2006. 
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Controls Recommended in FY 2000. Our review in FY 2000 recommended that 
the USD(P) revise DoD Directive 2040.2 to clearly state policies, procedures, and 
responsibilities of DoD and Military Department hosts for determining whether a 
deemed export license was required when a foreign national visits a Defense 
facility. Such a revision is important because, during the review in FY 2000, we 
found that more than 11,000 foreign nationals visited 6 research facilities within 
only 2 fiscal years. 

Controls Recommended in FY 2004. Our review in FY 2004 recommended that 
DUSD(TSP&NDP) expand interim guidance on export controls for biological 
agents and include the interim guidance in the DoD Directive. The guidance 
should include the roles and responsibilities of program managers and of 
counterintelligence, security, and foreign disclosure personnel. 

Also, we recommended the USD(AT&L): 

• develop and include in the DFARS an export clause that requires a 
contractor to comply with Federal export regulations and DoD guidance, 

• include an export-controlled technology clause in all subcontracts, and 

• conduct training and self-assessments. 

However, until DoD program managers are held accountable for identifying 
export-controlled technology and have controls in place to protect the export- 
controlled technology, DoD will be at increased risk of other nations’ countering 
or reproducing our technology. 

Controls Recommended in FY 2006. Most recently, in FY 2006, we 
recommended that DTS A: 

• record its analyses and insert documentation in the USXPORTS database 
to support recommendations made on export applications; 

• update export guidance to reflect current organizational titles, 
responsibilities, and structure; 

• grant DoD organizations without access to USXPORTS the access 
needed to facilitate reviews of export applications; and 

• develop effective management controls. 

Our recommendations were intended to help reduce the risk of allowing 
unjustified exports to China and to strengthen U.S. actions to maintain regional 
stability; hinder proliferation of nuclear, chemical, and biological weapons; and 
offset adverse effects on our national security. Until management fully 
implements the 10 recommendations, DoD will continue to accept avoidable risks 
in exporting sensitive goods, services, and technology that could threaten our 
national security. 
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Conclusion 


DoD organizations did implement 74 percent of the recommendations in seven 
reports issued from FY 2000 through FY 2006. However, these organizations 
need to continue taking actions to fully implement the 10 remaining 
recommendations. 

Normally, we request DoD organizations to comment on each recommendation, 
but we received those comments during the audit. Therefore, additional 
comments are not necessary on the prior recommendations. As a result of this 
audit, we are making new recommendations and asking management to comment 
on them. 

We will ask our Report Followup Division to continue to track the status of 
actions taken on the unimplemented recommendations during its periodic reviews. 
The division will monitor the status of the 10 unimplemented recommendations 
shown in Appendix C of this report. 


18 



Management Comments on the Finding and Audit Response 


USD(AT&L) Comments on the Finding. We issued a draft of this report on 
March 12, 2007. The Director of Defense Procurement and Acquisition Policy 
responded for the Under Secretary of Defense for Acquisition, Technology, and 
Logistics and neither concurred nor nonconcurred with our finding and 
recommendations, but provided comments. For the full text of the comments, see 
the Management Comments section of the report. 

The Director suggested that we edit and augment the finding to reflect the 
procedures involved with updating the Defense Federal Acquisition Regulation 
Supplement (DFARS). In addition, the Director requested clarification on the 
issuance of export guidance, training requirements for DoD research personnel, 
and responsibility for DoD Instruction 2040.2. For full text of the comments, see 
the Management Comments section of the report. 

Audit Response. We considered the Director’s comments related to the process 
for updating the DFARS. In consideration of the Director’s comments, we did 
not see that the addition of an explanation of the process for coordinating changes 
to the Supplement was needed to explain the current status of our 
recommendations. However, we revised the report to clarify our position that the 
proposed clause in the DFARS did not meet the intent of our prior 
recommendation, which requires contractors to conduct initial and periodic 
training and to perform periodic self-assessments on their compliance with 
Federal export laws and regulations. Therefore, the recommendation remains 
open until the clause is revised and published in the DFARS to address our 
recommendation. 

Also, we considered the Director’s comments on the proposed revision to the 
DFARS, related to issuing export guidance to and training of DoD personnel. As 
a result of reviewing those comments, we revised our finding to show that the 
draft policy guide issued by the Deputy Under Secretary of Defense for 
Technology Security Policy and National Disclosure Policy, “Managing Foreign 
Access: Implementing DoD Guidance on Restricted Technology,” should address 
our recommendations on issuing export guidance and training DoD personnel. 
However, the guide is a draft and the policies listed in the guide must be included 
in the revised DoD Instruction 2040.2 and published by USD(P). The 
recommendation remains open until the requirements are addressed in formal 
policy documents. 

In addition, we considered the Director’s comments concerning the responsibility 
for revising DoD Instruction 2040.2. We revised our report and requested that the 
Under Secretary of Defense for Policy complete the revisions and issue the 
Instruction (the Under Secretary of Defense for Policy is responsible for issuing 
DoD Instructions related to international transfers of technology, goods, services, 
and munitions). We acknowledge, but made no change in response to, the 
Director’s comments that no DoD Instruction is numbered 2040.2. The draft DoD 
Instruction 2040.2, “International Transfers of Technology, Goods, and Services,” 
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is replacing DoD Directive 2040.2, “International Transfers of Technology, 
Goods, Services, and Munitions.” 

Finally, we considered the Director’s comments related to responsiveness in 
implementing recommendations. The Director stated that he believed his office’s 
procedures for following up on our recommendations were adequate to ensure 
timely and responsive actions. However, management actions are still needed to 
implement our recommendations in a timely manner since we issued our audit 
report on March 25, 2004, and the recommendations remained outstanding as of 
March 29, 2007. Until the recommendations are implemented, some DoD 
program managers will not be held accountable for identifying and protecting 
export-controlled technology, and we will be at increased risk of other nations’ 
countering or reproducing our technology. 

DTSA Comments on the Finding. The Director (Acting) of the Defense 
Technology Security Administration nonconcurred with our findings related to 
her office. Specifically, the Director disagreed with our use of the policies in the 
Export Administration Regulations (EAR) for evaluating her office’s review of 
applications to export dual-use (military or civilian use) goods, services, and 
technologies. The Director stated that it is the responsibility of the Department of 
Commerce, not DoD, to use the EAR as a basis for evaluating export license 
applications. Also, the Director disagreed with our finding that her office was 
required to document reasons for all recommendations made on export 
applications. She commented that a statement of reasons was required only for 
recommendations to deny export licenses. In addition, the Director commented 
that her office had no statutory or regulatory authority to approve or deny export 
applications, merely to recommend a course of action to the licensing department. 

Further, she commented that DoD Instruction 2040.2 could not be finalized until 
the process for coordinating it within the Department was complete. Also, she 
stated that our audit did not consider the steps taken by her office to incorporate 
prior audit recommendations, many of which are included in the upcoming 
revision of DoD Instruction 2040.2, which has been in process for many months. 
For the full text, see DTSA Management Comments on page 37 of this report. 

Audit Response. The Director disagreed with our use of the policies identified in 
the EAR. However, DoD Directive 5010.38, “Management Control (MC) 
Program,” August 26, 1996, states that each DoD field activity (the Defense 
Technology Security Administration is a field activity) must implement 
management controls that provide reasonable assurance that programs, as well as 
administrative and operating functions, are efficiently and effectively carried out 
in accordance with applicable laws and management policy, such as the Export 
Administration Act (EAA) and the EAR. 

The EAA authorizes the Secretary of Commerce to issue policies and procedures 
for exporting dual-use items. The Secretary issued those policies and procedures 
in EAR for use in controlling and overseeing the export of dual-use items. Those 
export policies and procedures are applicable to agencies involved in overseeing, 
evaluating, recommending, and approving the requests for exports of sensitive 
technologies to countries of concern. Although the EAR does not require the 
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federal agencies involved in the export license process to review all export license 
applications submitted for consideration, those agencies responsible for making 
recommendations on exports of dual-use items, including DoD, are subject to 
addressing the requirements of the EAA and applicable regulations for those 
applications reviewed. Accordingly, it would be prudent for DTSA to follow 
those requirements when assessing export license applications because DTSA is 
the DoD activity responsible for reviewing, evaluating, and making 
recommendations to the Department of Commerce on such requests for dual-use 
items. The requirements of the EAR may help reduce the risk of allowing 
unjustified exports to China and to strengthen U.S. actions to maintain regional 
stability; hinder proliferation of nuclear, chemical, and biological weapons; and 
offset adverse effects on our national security. Although, our review was limited 
to evaluating export license applications to China, it would be prudent for DTSA 
to consider those factors in the EAR for all export license applications. 

Also, the Director disagreed with our finding that her office was required to 
document reasons for all recommendations made on export applications. She 
commented that a statement of reasons was required only for recommendations to 
deny export licenses. We addressed the need to document reasons for all 
recommendations in our report, “Controls Over Exports to China,” March 30, 
2006. That report cited the Principal Statutory Authority (Export Administration 
Act) for the EAR, which states that DoD will make and keep records of its advice, 
recommendations, or decisions, including the factual and analytical basis, 
connected with export licenses. 

In addition, that report cited the Government Accountability Office’s “Standards 
for Internal Control in the Federal Government,” November 1999, which stated, 
“Control activities occur at all levels and functions of the entity.” Those control 
activities include “approvals, authorizations, verifications, reconciliations, 
performance reviews, maintenance of security, and the creation and maintenance 
of related records which provide evidence of execution of these activities as well 
as appropriate documentation,” Furthermore, as demonstrated by our audit, 

DTSA did not maintain appropriate documentation to show the factual and 
analytical basis for recommending to the Department of Commerce their position 
on export license applications, 

We agree with the Director’s comment that her office had no statutory or 
regulatory authority to approve or deny export applications. We modified our 
report to show that her office was responsible only for recommending approval or 
denial of export applications to the Department of Commerce. Further, we agreed 
with the Director’s comment that DoD Instruction 2040.2 cannot be finalized until 
the coordination process is completed. We acknowledged this fact in our draft 
report; therefore, no change was made in this final report. 

DDR&E Comments oil the Finding. Although not required to comment, the 
Director of Defense Laboratory Programs, responding for the Director, Defense 
Research and Engineering, pointed out that our recommendation to complete DoD 
Instruction 2040.2 should be redirected to the Under Secretary of Defense for 
Policy. For the full text of the comments, see the Management Comments section 
of the report. 
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Audit Response. We agree with the comment by the Director of Defense 
Laboratory Programs about redirecting the responsibility for completing the draft 
DoD Instruction 2040.2 to the Under Secretary of Defense for Policy and adjusted 
the draft of this report accordingly. Also, we made the other changes that the 
Director requested to clarify statements he made during the audit. For instance, 
we adjusted this final report to show that training requirements for personnel at 
Defense research facilities depend on the content of yet-to-be-published revisions 
of the DFARS and DoD Instruction 2040.2. We also adjusted this final report to 
reflect the comments made regarding procedures included in the DFARS and 
DoD Instruction 2040.2. 

Recommendations, Management Comments, and Audit 
Response 

For clarity of presentation, we split a single recommendation (Recommendation 1. 
in our draft report) addressed to four organizations with open recommendations 
into four distinct recommendations below (Recommendations 1. through 4.). This 
format highlights each organization’s management comments. Also, we 
renumbered draft Recommendation 2. as Recommendation 2.b. 

1. We recommend that the Under Secretary of Defense for Acquisition, 
Technology, and Logistics establish followup procedures to ensure that 
timely and responsive actions are taken to implement all audit 
recommendations. 

Management Comments. The Director of Defense Procurement and Acquisition 
responded for the Under Secretary of Defense for Acquisition, Technology, and 
Logistics and neither concurred nor nonconcurred with our finding and 
recommendation, but provided comments. Specifically, the Director commented 
that his office’s followup procedures are adequate to ensure timely and responsive 
actions to implement our recommendations. The Director also stated 
implementation will be complete upon publication of the final DFARS rule. 

Audit Response. The Director’s comments were not fully responsive. Timely 
implementation of this recommendation is still needed. We issued our audit 
report on March 25, 2004, and the recommendation remained outstanding on 
March 29, 2007. Therefore, the potential risks we mentioned in our report on 
March 25, 2004, remain. That is, until DoD program managers are held 
accountable for identifying export-controlled technology and have controls in 
place to protect the export-controlled technology, DoD will be at increased risk of 
other nations’ countering or reproducing our technology. In accordance with 
DoD Directive 7650.3, we request that USD(AT&L) reconsider his response and 
send comments by October 29, 2007. 

2. We recommend that the Under Secretary of Defense for Policy: 

a. Establish followup procedures to ensure that timely and responsive 
actions are taken to implement all audit recommendations. 
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b. Complete and publish DoD Instruction 2040.2, “International 
Transfers of Technology, Goods, and Services.” 

Management Comments Required. The Under Secretary of Defense for Policy 
did not comment on a draft of this report. We request that the Under Secretary of 
Defense for Policy provide comments on the final report. 

3. We recommend that the Deputy Under Secretary of Defense for 
Technology Security Policy and National Disclosure Policy establish followup 
procedures to ensure that timely and responsive actions are taken to 
implement all audit recommendations. 

Management Comments Required. The Deputy Under Secretary of Defense 
for Technology Security Policy and National Disclosure Policy did not comment 
on a draft of this report. We request that the Deputy Under Secretary of Defense 
for Technology Security Policy and National Disclosure Policy provide comments 
on the final report by October 29, 2007. 

4. We recommend that the Director, Defense Technology Security 
Administration establish followup procedures to ensure that timely and 
responsive actions are taken to implement all audit recommendations. 

Management Comments Required. The Director, Defense Technology Security 
Administration did not comment on the recommendation. We request that the 
Director, Defense Technology Security Administration provide comments on the 
recommendation for the final report by October 29, 2007. 
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Appendix A. Scope and Methodology 


We conducted this performance audit from June 28, 2006, through March 12, 
2007, in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence obtained 
provides a reasonable basis for our findings and conclusions based on our audit 
objectives. 

We reviewed documents such as Executive Orders, Federal laws, and regulations, 
including the Export Administration Act and the associated Export 
Administration Regulations. In addition, we evaluated the adequacy of DoD 
directives, policies, and regulations related to the transfer of militarily sensitive 
technology to countries of concern. 

We interviewed personnel in the following organizations: 

• Department of Commerce; 

• Under Secretary of Defense for Acquisition, Technology, and 
Logistics; 

• Office of the Deputy Under Secretary of Defense for Technology 
Security Policy and National Disclosure Policy; 

• Director, Defense Research and Engineering; and 

• Defense Technology Security Administration. 

Our contacts with personnel in these organizations included discussions on the 
implementation of recommendations in the previously issued audit reports. 

We limited our review to open recommendations in audit reports we issued to 
comply with Public Law 106-65. Only DoD IG Reports No. D-2006-067, 
D-2004-061, and D-2000-0110 contained open recommendations. 

To complete this review, we judgmentally selected a sample of 40 export license 
applications from 3,489 export license applications processed in calendar years 
2005 and 2006. We obtained the complete USXPORTS file on each of the 
40 selected applications to determine whether DTSA analysis, documentation, 
and elevation procedures achieved the recommended actions made in DoD IG 
Report No. D-2006-067. 

Use of Computer-Processed Data. USXPORTS is the automated system that 
DTSA uses for processing export applications. We used computer-processed data 
from USXPORTS to identify export license applications for China. Testing the 
reliability of the computer-processed data was not the purpose of this audit; the 
data were used strictly as source documentation. We thoroughly compared the 
contents of each selected export license application with supporting 
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documentation. Nothing came to our attention as a result of the testing that 
caused us to doubt the reliability of the computer-processed data. 

Use of Technical Assistance. We received technical assistance from the DoD 
Office of Inspector General’s Quantitative Methods Division, which advised us 
on the selection of the sample size. 

Government Accountability Office High-Risk Area. The Government 
Accountability Office has identified several high-risk areas in the Department of 
Defense. This report does not cover any DoD high-risk areas, but this report does 
address the Government Accountability Office’s newly designated Federal 
Government-wide high-risk area of “Ensuring the Effective Protection of 
Technologies Critical to U.S. National Security Interests.” 13 


13 The Government Accountability Office designated this area as being high-risk in January 2007. 
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Appendix B. Prior Coverage 


During the last 5 years, the Government Accountability Office (GAO) and the 
Department of Defense Inspector General (DoD IG) have conducted multiple 
reviews regarding the adequacy of export controls. Unrestricted GAO reports can 
be accessed over the Internet at http://www.gao.gov. Unrestricted DoD IG reports 
can be accessed at http://www.dodig.mil/audit/reports. The following previous 
reports are of particular relevance to the subject matter in this report. 


GAO 


GAO Report No. GAO-Ol-528, “Export Controls: State and Commerce 
Department License Review Times are Similar,” June 1, 2001 

DoD IG 


DoD IG Report No. D-2006-067, “Controls Over Exports to China,” March 30, 
2006 

DoD IG Report No. D-2005-042, “Controls Over the Export Licensing Process 
for Chemical and Biological Items,” March 30, 2005 

DoD IG Report No. D-2004-061, “Export Controls: Export-Controlled 
Technology at Contractor, University, and Federally Funded Research and 
Development Center Facilities,” March 25, 2004 

DoD IG Report No. D-2003-070, “Export Controls: DoD Involvement in Export 
Enforcement Activities,” March 28, 2003 

DoD IG Report No. D-2002-039, “Automation of the DoD Export License 
Application Review Process,” January 15, 2002 

DoD IG Report No. D-2001-088, “DoD Involvement in the Review and Revision 
of the Commerce Control List and the U.S. Munitions List,” March 23, 2001 

DoD IG Report No. D-2000-0110, “Export Licensing at DoD Research 
Facilities,” March 24, 2000 

Interagency Reviews 


Inspectors General of the Departments of Commerce, Defense, Energy, State, 
Homeland Security, Agriculture, and the Central Intelligence Agency Report 
No. D-2005-043, “Interagency Review of the Export Licensing Process for 
Chemical and Biological Commodities,” June 10, 2005 
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Inspectors General of the Department of Commerce, Defense, Energy, Homeland 
Security, and State and the Central Intelligence Agency Report No. D-2004-061, 
“Interagency Review of Foreign National Access to Export Controlled 
Technology in the United States,” April 16, 2004 

Offices of Inspector General Department of Commerce, Defense, State, and the 
Treasury; the Central Intelligence Agency; and the U.S. Postal Service Report 
No. D-2003-060, “Interagency Review of Federal Export Enforcement Efforts,” 
April 18, 2003 

Inspectors General of the Departments of Commerce, Defense, Energy, State, and 
the Treasury Report No. D-2002-074, “Interagency Review of Federal Automated 
Export Licensing Systems,” March 29, 2002 

Inspectors General of the Departments of Commerce, Defense, Energy, and State 
Report No. D-2001-092, “Interagency Review of the Commerce Control List and 
the U.S. Munitions List,” March 23, 2001 

Office of the Inspector General Department of Defense, Office of Intelligence 
Review, Report No. 00-OIR-05, “Measures to Protect Against the Illicit Transfer 
of Sensitive Technology,” March 27, 2000 

Offices of the Inspectors General Departments of Commerce, Defense, Energy, 
and State Report No. D-2000-109, “Interagency Review of the Export Licensing 
Process for Foreign National Visitors,” March 24, 2000 
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Appendix C. Status of Prior Recommendations 


Implementation of Recommendations 




Status of Recommendations 


Report 

Recommendation 

Number 

As of June 28, 2006 

Not 

Implemented Implemented 

As of December 21,2006 

Not 

Implemented Implemented 

D-2006-0067-D000LS-0001 

l.a 

0 

1 

0 

1 

D-2006-0067- D000LS-0001 

l.b 

0 

1 

0 

1 

D-2006-0067-D000LS-0001 

2.a 

0 

1 

0 

1 

D-2006-0067-D000 LS-0001 

2.b 

0 

1 

1 

0 

D-2006-0067-D000LS-0001 

2.c 

0 

1 

0 

1 

D-2006-0067-D000 LS-0001 

2.d 

0 

1 

0 

1 

D-2006-0067-D000LS-0001 

2.e 

0 

1 

0 

1 

D-2005-0042-D000LG-0002 

1 

1 

0 

1 

0 

D-2004-0061-D000LG-0001 

l.a 

0 

1 

0 

1 

D-2004-0061-D000LG-0001 

l.b 

0 

1 

0 

1 

D-2004-0061 -D000LG-0001 

2.a 

0 

1 

0 

1 

D-2004-0061 -D000LG-0001 

2.b 

1 

0 

1 

0 

D-2003-0070-D000LG-0001 

A.1 

1 

0 

1 

0 

D-2003-0070-D000LG-0001 

A.2 

1 

0 

1 

0 

D-2003-0070-D000LG-0001 

A.3 

1 

0 

1 

0 

D-2002-0039-D000LG-0001 

1 

1 

0 

1 

0 

D-2002-0039-D000LG-0001 

2 

1 

0 

1 

0 

D-2002-0039-D000LG-0001 

3 

1 

0 

1 

0 

D-2002-0039-D000LG-0001 

4 

1 

0 

1 

0 

D-2001-0088-D000LG-0001 

A.1 

1 

0 

1 

0 

D-2001-0088-D000LG-0001 

A.2 

1 

0 

1 

0 

D-2001 -0088-D000LG-0001 

A.3 

1 

0 

1 

0 

D-2001 -0088-D000LG-0002 

B.2.a 

1 

0 

1 

0 

D-2001 -0088-D000LG-0002 

B.2.b 

1 

0 

1 

0 

D-2001 -0088-D000LG-0002 

C.2 

1 

0 

1 

0 

D-2001 -0088-D000LG-0003 

B.1 

1 

0 

1 

0 

D-2001 -0088-D000LG-0003 

C.1 

1 

0 

1 

0 

D-2000-0110-D000LA-0001 

A.1.a 

0 

1 

1 

0 

D-2000-0110-D000LA-0001 

A.I.b 

0 

1 

0 

1 

D-2000-0110-D000LA-0001 

A.I.c 

1 

0 

1 

0 

D-2000-0110-D000LA-0001 

A.2.a 

1 

0 

1 

0 

D-2000-0110-D000LA-0001 

A.2.b 

1 

0 

1 

0 

D-2000-0110-D000LA-0001 

A.2.C 

0 

1 

1 

0 

D-2000-0110-D000LA-0001 

A.2.d 

0 

1 

1 

0 

D-2000-0110-D000LA-0002 

B.1.a 

1 

0 

1 

0 

D-2000-0110-D000LA-0002 

B.I.b 

1 

0 

1 

0 

D-2000-0110-D000LA-0002 

B.2 

1 

0 

1 

0 

D-2000-0110-D000LA-0002 

B.3 

1 

0 

1 

0 

D-2000-0110-D000LA-0002 

B.4 

1 

0 

1 

0 

Total 


25 

14 

29 

10 
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Appendix D. Assessment of Export Applications 


CY 2005 and CY 2006 Assessment of DTSA Applications for Making Exports to China 


Sample 

Number 

USXPORTS 
File Number 

Export Control 
Classification 
Number 

Adeauate 

Analysis 

Adeauate 

Documentation 

DTSA Recommendation 

1 

D347546 

2A983 

No 

No 

AWC 

2 

D337344 

1C350 

No 

No 

AWC 

3 

D344327 

3A231 

No 

No 

AWC 

4 

D340340 

6A003 

No 

No 

AWC 

5 

D333544 

1C350 

No 

No 

AWC 

6 

D333545 

1C350 

No 

No 

AWC 

7 

D329056 

6A003 

No 

No 

AWC 

8 

D337063 

1C350 

No 

No 

AWC 

9 

D342226 

6A003 

No 

No 

AWC 

10 

D331360 

6A003 

No 

No 

AWC 

11 

D322475 

6A003 

No 

No 

AWC 

12 

D340947 

1C350 

No 

No 

AWC 

13 

D348973 

2A983 

No 

No 

AWC 

14 

D332675 

6A003 

Yes 

No 

AWC 

15 

D344183 

6A003 

No 

No 

AWC 

16 

D343704 

1C350 

No 

No 

AWC 

17 

D347548 

2A983 

No 

No 

AWC 

18 

D336673 

1C350 

No 

No 

AWC 

19 

D336321 

1C350 

No 

No 

AWC 

20 

D332824 

2A983 

No 

No 

AWC 

21 

D326299 

1C350 

No 

No 

Disapproved 

22 

D332399 

6A003 

No 

No 

Disapproved 

23 

D332835 

6A003 

No 

No 

Disapproved 

24 

D335081 

6A003 

Yes 

No 

Disapproved 

25 

D335082 

6A003 

Yes 

No 

Disapproved 

26 

D340344 

6A003 

Yes 

No 

Disapproved 

27 

D342044 

6A003 

Yes 

No 

Disapproved 

28 

D345271 

6A003 

Yes 

No 

Disapproved 

29 

D349729 

6A003 

Yes 

No 

Disapproved 

30 

D346795 

6A003 

Yes 

No 

Disapproved 

31 

D363862 

1C350 

No 

No 

AWC 

32 

D359155 

1C350 

No 

No 

AWC 

33 

D357867 

1C350 

No 

No 

AWC 

34 

D367495 

2A983 

No 

No 

AWC 

35 

D361730 

2A983 

No 

No 

AWC 

36 

D368316 

2A983 

No 

No 

AWC 

37 

D364144 

3A231 

No 

No 

AWC 

38 

D360724 

3A231 

Yes 

No 

AWC 

39 

D355231 

6A003 

N/A 

N/A 

RWA 

40 

D364201 

6A003 

Yes 

No 

Disapproved 


(The first 30 applications represent Calendar Year (CY) 2005 and the remaining 10 represent CY 2006 applications.) 6A003- 
Sensors and Lasers; lC350-Chemicals and Toxins; 2A983-Explosives; 3A231-Electronics; AWC-Approved With Conditions; 
RWA-Returned Without Action; and N/A-Not Applicable. 


29 



Appendix E. Report Distribution 


Office of the Secretary of Defense 

Under Secretary of Defense for Acquisition, Technology, and Logistics 
Director, Defense Research and Engineering 
Deputy Under Secretary of Defense (Science and Technology) 

Under Secretary of Defense for Policy 

Deputy Under Secretary of Defense (Technology Security Policy and National 
Disclosure Policy) 

Under Secretary of Defense (Comptroller)/Chief Financial Officer 
Deputy Chief Financial Officer 
Deputy Comptroller (Program/Budget) 

Under Secretary of Defense for Intelligence 

Assistant to the Secretary of Defense (Nuclear and Chemical and Biological Defense 
Programs) 

Director, Program Analysis and Evaluation 


Joint Staff 

Director, Joint Staff 

Director, Plans and Policy Directorate (J-5), Joint Staff 

Director, Force Structure, Resources, and Assessment Directorate (J-8), Joint Staff 


Department of the Army 

Inspector General, Department of the Army 

Director, Joint Program Executive Office (Chemical and Biological Defense) 


Department of the Navy 

Naval Inspector General 

Auditor General, Department of the Navy 


Department of the Air Force 

Auditor General, Department of the Air Force 


Combatant Command 

Inspector General, U.S. Joint Forces Command 
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Other Defense Organizations 

Director, Defense Intelligence Agency 

Director, Defense Logistics Agency 

Director, Defense Security Service 

Director, Defense Technology Security Administration 

Director, National Security Agency 


Non-Defense Federal Organizations 

Office of Management and Budget 

Inspector General, Department of Agriculture 

Inspector General, Department of Commerce 

Inspector General, Department of Energy 

Inspector General, Department of Health and Human Services 

Inspector General, Department of Homeland Security 

Inspector General, Department of State 

Inspector General, Department of Treasury 

Inspector General, Central Intelligence Agency 

Inspector General, U.S. Postal Service 

U.S.-China Economic and Security Review Commission 

Congressional Committees and Subcommittees, Chairman and 
Ranking Minority Member 

Senate Committee on Appropriations 

Senate Subcommittee on Defense, Committee on Appropriations 
Senate Committee on Armed Services 

Senate Committee on Homeland Security and Governmental Affairs 
Senate Select Committee on Intelligence 
Senate Committee on Foreign Relations 
House Committee on Appropriations 

House Subcommittee on Defense, Committee on Appropriations 

House Committee on Armed Services 

House Committee on Oversight and Government Reform 

House Subcommittee on Government Management, Organization, and Procurement, 
Committee on Oversight and Government Reform 
House Subcommittee on National Security, and Foreign Affairs, Committee on Oversight 
and Government Reform 

House Subcommittee on Information Policy, Intergovernmental Relations, and the 
Census, Committee on Government Reform 

House Subcommittee on Terrorism, Nonproliferation, and Trade, Committee on Foreign 
Affairs 

House Permanent Select Committee on Intelligence 
House Subcommittee on Oversight and Investigations 
House Committee on Homeland Security 
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Under Secretary of Defense for Acquisition. 
Technology, and Logistics Comments 


Final Report 
Reference 



OFFICE OF THE UNDER SECRETARY OF DEFENSE 
3000 DEFENSE PENTAGON 
WASHINGTON, DC 20301-3000 

MAR 26 2007 


MEMORANDUM FOR PROGRAM DIRECTOR, READINESS AND OPERATIONS 
SUPPORT, OFFICE OF THE INSPECTOR GENERAL 

^THROUGH: DIRECTOR, ACQUISITION RESOURCES AND ANALYSIS 

SUBJECT: Followup Audit on Recommendations for Controls Over Exporting Sensitive 
Technologies to Countries of Concern (Project No. D2006-D000LG- 
0199.000) (Your Memo dated March 12,2007) 

As requested, we have reviewed the draft report and offer the following 


1. The Office of Defense Procurement and Acquisition Policy (DPAP) has responsibility 
for Recommendations 2.a. and 2.b. in Report D-2006-061 dated 25 March 2004. 

a. The Ending (on page 6 of the draft report) regarding the status of 
OUSD(AT&L) DPAP action on these recommendations should be edited and 
augmented to reflect that (1) completing the action to implement 
Recommendations 2.a. and 2.b. requires compliance with the formal 
rulemaking process that applies to the DoD Federal Acquisition Regulation 
Supplement (DFARS), (2) the implementing action is not limited to 
publication of a single clause but involves publication of a DFARS rule that 
includes contract clauses for use in particular circumstances, (3) DoD 
published a proposed rule on 12 July 2005, and based on public comments 
received by the October 2005 deadline, made substantial revisions to it; (4) 
DoD published the second proposed rule on 14 August 2006, and received 
public comments from 167 persons or organizations by the deadline of 2 
November 2006; (5) the DAR Council has agreed upon a draft final rule based 
on consideration of public comments received on the second proposed rule, 
and the draft final rule is now in the last stages of the formal rulemaking 
process. Publication of the final rule is expected within about 90 days. 

b. A clarification is needed on page 11 under “Issuance of Guidance”. The 
DFARS rule does not contain procedures for determining whether goods, 
services, and technology at Defense research facilities are exportable with or 
without a license. What the DFARS rule does is to assign responsibility to 
requiring activities for determining if, during performance of a contemplated 
contract, the contractor will generate or require access to export-controlled 
information or technology. 

c. A correction is needed on pages 11-12 under “Training Requirements for 
Defense Research Personnel”. There are no training requirements in the 
DFARS rule. Although the DFARS rule does not mandate training, the 


Set, 






Revised 


Revised 
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Final Report 
Reference 


Revised 


Page 22 
Deleted 


Page 22 


DFARS R&D Committee, the DAR Council, DPAP, DDRE, and DTSA 
recognize the importance of training for contracting officers and requiring 
activity officials who will implement the new DFARS rule. DDRE will lead 
the effort to ensure appropriate training is available to requiring activities and 
DPAP will lead the effort to ensure appropriate training is available for 
contracting officers. The two training efforts will be coordinated since the 
requiring activities and the contracting officers work interactively. The 
content of contracting officer training is dependent upon the specifics of the 
DFARS rule. The content of the requiring activity training is dependent upon 
the specifics of both the DFARS rule and the revised DoDD 2040.2. 

Therefore a comprehensive training syllabus cannot be designed until the rule 
and directive are complete. 

2. DPAP does not have responsibility for DoD Directive 2040.2. There is a suggestion 
in the draft report that there is a linkage between publication of the DFARS rule, for 
which DPAP has responsibility, and publication of a new 2040.2. There is no such 
linkage. (Incidentally, references in the report to DoDI 2040.2 should be changed to 
DoDD 2040.2. There is not DoD Instruction numbered 2040.2.) 

3. The draft report’s references to USD(AT&L) being responsible for DoDD 2040.2 are 
confusing, especially since the summary regarding previous recommendations 
directed to USD(P) (at the top of page 7) and Recommendation 2 (on page 18) of this 
draft report recognize that responsibility for publishing 2040.2 rests with the USD(P). 
For example, the statements on pages 11 and 12 of the draft report that a 
USD(AT&L) official “could not provide a planned completion date for DoDI 2040.2, 
which remains in draft” are irrelevant since USD(AT&L) is responsible for neither 
the draft nor the final document. We suggest that the report be clarified in this regard. 

4. DPAP defers to OUSD(AT&L) ARA with regard to Recommendation 1 on page 18 
of the draft report. From DPAP’s perspective, OUSD(AT&L) follow-up procedures 
are adequate to ensure timely and responsive actions are taken to implement the IG 
recommendation assigned to DPAP. DPAP has provided periodic follow-up status 
reports on actions taken to implement Recommendations 2.a. and 2.b. of OIG Report 
D-2004-061. Implementation will be complete upon publication of the final DFARS 
rule. 

If you require further information, please contact Barbara Glotfelty at 703-697- 

9351 or barbara.glotfeltv@osd.mil . 


r Shay D. As^fd / 

Director, Def^n/e Procurement 
and Acquisition Policy 
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Defense Research and Engineering Comments 

Final Report 
Reference 

OFFICE OF THE DIRECTOR OF 

DEFENSE RESEARCH AND ENGINEERING 

gAAn^B 3040 DEFENSE PENTAGON 

HI BF JO WASHINGTON, DC 20301-3040 


MAR 2 G 2007 


MEMORANDUM FOR PROGRAM DIRECTOR, READINESS AND 

OPERATIONS SUPPORT, OFFICE OF THE 

INSPECTOR GENERAL 


SUBJECT: Follow-up Audit on Recommendations for Controls Over Exporting 

Sensitive Technologies to Countries of Concern, Project No. D2006- 
D000LG-0199.000 (Draft of a Proposed Report dated March 12, 

2007) 


As requested, I have reviewed the draft report. The draft report is generally 
well written. The findings germane to DDR&E are commendable. A few 
statements within the report contain errors, and while the errors do not lead to 
incorrect findings, the errors should be corrected to increase the overall accuracy 
and credibility of the report, its findings, and recommendations. 


1. The Director, Defense Research and Engineering (DDR&E) has 

responsibility for two recommendations in Report D-2000-110 dated March 

24,2000. I do not repeat those recommendation. They appear on page 11 
of the draft report. 


a. The statement in the Issuance of Guidance section (page 11) “.. .the 

Defense Federal Acquisition Regulation Supplement (DFARS), 
together with DoDI 2040.2 will include these procedures.” is not 
precisely correct. The DDR&E official should have said “.. .the 
pending DoDI 2040.2 will provide procedures and the pending 

Defense Federal Acquisition Regulation Supplement (DFARS) rule 
will provide specific contract clauses to use in particular 
circumstances.” 

Revised 

b. The first sentence in the next paragraph should be changed. It says 

USD(AT&L) is responsible for finalizing DoDI 2040.2. That is 
incorrect. The last sentence in the same paragraph is correct. 

USD(P) is responsible for DoDI 2040.2. Change the first sentence 
to read “a DDR&E official told us that the USD(AT&L) is 
responsible for finalizing the DFARS rule and the USD(P) is 
responsible for finalizing DoDI 2040.2.” 

Revised 

c. The statement in the Training Requirements for Defense Research 

Personnel section (pages 11 & 12) “...a DDR&E official informed 

Revised 

0 
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Final Report 
Reference 


Deleted 
Page 11 


us that the training requirements for personnel at Defense research 
facilities are in a proposed revision of the DFARS and a draft 
revision of DoDI 2040.2” is not precisely correct. The DDR&E 
official should have enabled you to write “.. .a DDR&E official 
informed us that the training requirements for personnel at Defense 
research facilities are dependent upon the content yet to be published 
in a revision of the DFARS rule and a revision of DoDI 2040.2.” 

d. The last sentence in the next paragraph (page 12) should say 
“Further, DDR&E officials told us that the USD(AT&L) is 
responsible for finalizing the DFARS and USD(P) is responsible for 
finalizing DoDI 2040.2.” 

If you require further information, please contact Jon Porter at 703-588-1415 
or ionathan.porter@osd.mil . 

J m — 

James M. Short 

Director, Defense Laboratory Programs 
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Final Report 
Reference 


Defense Technology Security Administration 
Comments 



DEFENSE TECHNOLOGY SECURITY ADMINISTRATION 

2900 DEFENSE PENTAGON 
WASHINGTON, DC 20301-2900 


Mr. Dennis L, Conway 

Program Director 

Readiness and Operations Support 

Office of tiie Inspector General 

Department of Defense 

400 Army Navy Drive 

Arlington, Virginia 22202 


APR 2 7 2007 


Dear Mr. Conway: 

My staff has reviewed your draft report entitled: “Followup Audit on 
Recommendations for Controls Over Exporting Sensitive Technologies to Countries of 
Concern” (Project No. D2006-DOOOLG-0199.000). While I appreciate the effort your 
staff expended on this project, I am concerned that it does not accurately portray the 
actions DTSAhas undertaken based upon your earlier findings. In fact, I am compelled 
to non-concur in several areas that we feel are inaccurate or misleading. The two 
recommendations I am referring to follow: 


I. IG Recommendation: Documentation of Decisions on Export Applications 

DTSA does not concur with the IG finding and recommendation. This non¬ 
concurrence is based upon the fact that the IG audit was based upon several erroneous 
assumptions: 

First, the IG selected the Export Administration Regulation (EAR) as the standard 
for analysis. Though DTSA does not disagree that these are important policies to be 
confirmed prior to approval of a license, they are the responsibility of the Department of 
Commerce (DoC), not the DoD. EO 12981 grants DoD the authority to review any 
license received by the DoC and permits DoD to notify DoC of any application it does 
not wish to review. However, the EO prescribes no standard to be used by DoD to either 
request or defer review. It should therefore be assumed that the standard for analysis 
likewise rests with DoD, not DoC and its policies in the EAR. DTSA has provided 
copies of numerous standard operating procedures and identified policies which form the 
basis of DoD analysis. These, not the EAR standards, should be considered controlling 
in this case. For DoD to concentrate its review solely on the DoC policies would be both 
redundant and could indeed jeopardize review of DoD equities. 

Second, when using the EAR as a standard for review, the auditors’ findings state 
that the analysis and documentation were inadequate to justify the decision by DTSA to 
“approve” license applications. We believe this is incorrect on several levels. DTSA 




Revised 
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Final Report 
Reference 


Revised 


has no statutory or regulatory authority to approve or deny license applications, merely to 
recommend a course of action to the licensing department. More importantly the EO 
requires that only recommendations to deny a license “include a statement of the reasons 
for such recommendation that are consistent with” the EAR. No such requirement exists 
for other recommendations. Finally, the EO further states that if no recommendation is 
received within 30 days of referral, the referral department will “be deemed to have no 
objection to the decision” by the Secretary of Commerce. Devoting resources to 
document analysis and recommendations that DoD has determined to have no national 
security implications would not be a prudent use DoD assets and could potentially 
jeopardize DoD’s ability to provide the documentation and analysis required to stop 
exports of national security concern. 

Third, despite many discussions, reviews, and instruction by the DTSA staff we 
believe that the auditors did not fully take into account the extensive information that was 
available in the USXports database, the relationship between the requirements of the 
procedures in place and the entries made therein, nor the significance of the decision to 
the overall process. The procedures in place require that the analyst review the end user, 
the end use and the technology to determine if there are concerns raised by the 
application in these areas. At each level of review, whether by the “tiger team” on receipt 
or after staffing, the analyst is required to analyze these areas and determine if there is a 
national security concern generated by any of these elements of the prospective export 
using these guidelines. The releasing official is certifying, in the ease of a 
recommendation of approval, that no national security concern exists or, in the case of an 
approval with conditions, that these concerns have been adequately addressed in the 
conditions. Ergo, the entire case, the procedural requirements and final determination 
constitute the documentation that these issues have been addressed. The auditors seem to 
require that a “checklist” or other summary, redundantly documenting these requirements 
were met, be appended to each case record. The IG comments included a 
recommendation that reference to a precedent case in the USXports database, by case 
number, was insufficient documentation to support its use as a precedent, but rather the 
entire case would have to be copied into the case at the tool bar. The cost in analysts’ 
time and resources would be extraordinary and would probably not be considered a wise 
use of resources, unsupported by risk involved. 

Given the facts above, DTSA will take no further action on this recommendation. 

2. Recommendation: Implementation of prior recommendations in 2040.2 

DTSA does not concur with the IG finding and recommendation. This non¬ 
concurrence is based upon the fact that the IG audit did not take into account the steps 
taken by DTSA in incorporating their prior suggestions. 
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u I oa personnel have on many occasions explained and demonstrated to the 
t l hat , their ^commendations are incorporated into the revised version of 
2040.2 feat has been in the staffing process for many months and is now approaching 
approval. Unfortunately, as my staff explained to the IG team, 2040.2 carrnot be finalized 
until the coordination process is complete. 


My point of contact for IG matters is Dr. Peter Leitner 
703-325-4080. 



Beth M. McCormick 
Director (Acting), 
Defense Technology 
Security Administration 




Team Members 

The Department of Defense Office of the Deputy Inspector General for Auditing, 
Readiness and Operations Support prepared this report. Personnel of the 
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Gustavo Rivera-Morales 
Jerel L. Morton 
Norka Murat 
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U.S. Department of Energy 
Office of Inspector General 
Office of Inspections and Special Inquiries 



Inspection Report 

Review of Status of Prior Export Control 
Recommendations at the Department 
of Energy 


INS-O-07-01 


May 2007 





Department of Energy 

Washington, DC 20585 
May 22 , 2007 


MEMORANDUM FOR THE DEPUTY ADMINISTRATOR, DEFENSE NUCLEAR 
NONPROLIFERATION 

/: CHIEF HEALTH, SAFETY AND SECURITY OFFICER 


Inspector General 


SUBJECT: INFORMATION : Inspection Report on “Review of Status of 

Prior Export Control Recommendations at the Department of 
Energy” 


BACKGROUND 


The National Defense Authorization Act for Fiscal Year 2000 provided that beginning in 
the year 2000 and ending in the year 2007, the President shall annually submit to 
Congress a report by the Inspectors General of the Departments of Energy, Commerce, 
Defense, and State of the policies and procedures of the United States Government with 
respect to the export of technologies and technical information with potential military 
application to countries and entities of concern. Prior to the review which is the subject 
of this report, the Energy Office of Inspector General had issued seven reports under this 
requirement and had made 17 recommendations to Energy, including the National 
Nuclear Security Administration (NNSA), designed to improve the Department of 
Energy’s export control efforts. The objective of this inspection was to determine the 
status of all 17 prior export control recommendations. Details on the prior 
recommendations are provided in Appendix C. 

RESULTS OF INSPECTION 

We concluded that the actions taken by Energy regarding the 14 closed recommendations 
appeared to be responsive and that these recommendations should remain closed. We 
also concluded that two of the three remaining open recommendations should be closed. 
Finally, we made two additional recommendations based upon this review. Regarding 
the three open recommendations, we determined that: 

• The two recommendations pertaining to NNSA and Commerce’s Export 
Control Automated Support System should be closed because NNSA has found 
alternate ways to access the necessary data; and 

• The remaining recommendation to ensure that export control guidance is 
disseminated and implemented throughout the complex should remain open 
because it was incomplete. 
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Regarding the two additional recommendations resulting from this review, we 
determined that: 

• NNSA management should expedite action, such as issuing a directive or 
modifying the Department of Energy Acquisition Regulation, to fully 
implement the open recommendation; and, 

• Energy Order 142.3, “Unclassified Foreign Visits and Assignments,” should be 
revised to reflect the current Energy process for reviewing foreign national 
visitors and assignees from state sponsors of terrorism. 

In addition to this inspection, the Office of Inspector General is conducting a separate 
review of Energy’s audit resolution and follow-up process. The latter review covers 
corrective actions taken by management to address identified control weaknesses in other 
Department of Energy programs and administrative activities. 

MANAGEMENT REACTION 

Management of NNSA and the Chief Health, Safety and Security Officer agreed with our 
recommendations. Management’s comments are provided in their entirety in 
Appendix D of the report. 

Attachment 

cc: Chief of Staff 

Director, Office of Intelligence and Counterintelligence 
Director, Office of Internal Review (CF-1.2) 

Director, Policy and Internal Controls Management (NA-66) 
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Overview 


INTRODUCTION 
AND OBJECTIVES 


The National Defense Authorization Act (NDAA) for Fiscal Year 
2000 provided that beginning in the year 2000 and ending in the 
year 2007, the President shall annually submit to Congress a report 
by the Inspectors General of, at a minimum, the Departments of 
Energy (Energy), Commerce (Commerce), Defense (Defense), and 
State (State) of the policies and procedures of the United States 
Government with respect to the export of technologies and 
technical information with potential military application to 
countries and entities of concern. To date, the Energy Office of 
Inspector General (OIG) has issued 7 reports under this 
requirement and has made 17 recommendations to Energy, 
including the National Nuclear Security Administration (NNSA), 
towards improving Energy’s export control efforts. A listing of 
these and other export related reports is contained in Appendix B. 

The objective of this inspection was to determine the status of all 
17 prior export control recommendations. Details on the 
recommendations and managements’ responses are provided in 
Appendix C. 
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OBSERVATIONS AND 
CONCLUSIONS 


We concluded that the actions taken by Energy regarding the 14 
closed recommendations appeared to be responsive and that these 
recommendations should remain closed. We also concluded that 
two of the three remaining open recommendations should be 
closed. Finally, we made two additional recommendations based 
upon this review. Regarding the three open recommendations, we 
determined that: 

• The two recommendations pertaining to NNSA and 
Commerce’s Export Control Automated Support System 
should be closed because NNSA has found alternate ways to 
access the necessary data; and 

• The one recommendation to ensure that export control 
guidance is disseminated and implemented throughout the 
complex should remain open because it is incomplete. 

Regarding the two additional recommendations, we determined 
that: 

• NNSA management should expedite action, such as issuing a 
directive or modifying the Department of Energy Acquisition 
Regulation (DEAR), to fully implement the open 
recommendation; and 

• Energy Order 142.3, “Unclassified Foreign Visits and 
Assignments,” should be revised to reflect the current Energy 
process for reviewing foreign national visitors and assignees 
from state sponsors of terrorism. 

Presently, the OIG is conducting an audit of the Department’s 
unclassified foreign visits and assignments program, which 
includes issues that were covered in our previous reports and 
recommendations. The OIG is also conducting an inspection of 
foreign national access to computers, which also relates to foreign 
visits and assignment activities. Although our office has 
conducted several reviews on foreign visitor-related topics, the 
reviews above may identify additional areas for improvement. 
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Details of Findings 


BACKGROUND The principal legislative authorities governing the export control of 

nuclear-related, dual-use 1 items are the Export Administration Act 
of 1979 and the Nuclear Non-Proliferation Act of 1978. The 
provisions of the Export Administration Act have been updated by 
Executive Order, most recently by Executive Order 12981, which 
grants the Secretary of Commerce the authority to refer export 
license applications to other agencies for review and gives 
agencies such as Energy the authority to look at any export license 
application submitted to Commerce. 

Energy’s export control efforts, as coordinated by NNSA’s Office 
of International Regimes and Agreements (OIRA), includes the 
review of export license applications for nuclear, chemical, 
biological, and missile-related commodities. In addition to 
reviewing licenses, OIRA participates in working level groups 
with other Federal agencies for licensing and nonproliferation 
activities. Also, Energy’s Office of Foreign Visits and 
Assignments establishes Energy policies for the review and 
processing of visits and assignments by foreign nationals to Energy 
and NNSA facilities. Reviews of foreign visits and assignments 
are relevant to Energy’s export control efforts because any release 
of technology or software subject to U.S. Export Administration 
Regulations to a foreign national is “deemed to be an export” to the 
foreign national’s home country. 

ACCESS TO THE We determined that the two recommendations pertaining to NNSA 

COMMERCE EXPORT and Commerce’s Export Control Automated Support System 

LICENSE DAT ABASE should be closed because NNSA has found alternate ways to 

access the necessary data. 

During March 2005, we issued a report entitled “The Department of 
Energy’s Review of Chemical and Biological Export License 
Applications,” DOE/IG-0682, which had two recommendations 
regarding access to and training on Commerce’s Export Control 
Automated Support System (ECASS). We had determined that 
although information from ECASS was obtained by officials at the 
Los Alamos National Laboratory for Energy’s export license 
reviews, only one OIRA Headquarters official had access to ECASS 
and no OIRA Headquarters officials were trained in ECASS. We 
were advised by OIRA officials during 2005 that a lack of direct 
access to and training in ECASS was a problem for the timely and 


1 Some controlled commodities are designated as “dual-use,” that is, goods and technologies that have both civilian 
and military uses. The U.S. Government designates some dual-use commodities as “nuclear dual-use” items, 
which are controlled for nuclear nonproliferation purposes. 
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EXPORT CONTROL 
GUIDANCE 


efficient review of export licenses by OIRA Headquarters officials. 
Accordingly, we made the ECASS recommendations. Both 
recommendations remained open when we initiated this review. 

Since these two recommendations were made, OIRA Headquarters 
officials have made continual efforts to receive access to and 
training on ECASS. Although Commerce has provided access to 
ECASS, access has not been effective because of recurring 
problems in maintaining connectivity with ECASS by OIRA 
Headquarters. We were advised by OIRA officials that these 
connectivity problems resulted from computer system changes at 
Commerce. OIRA officials further advised that they have not 
received ECASS training; however, due to the lack of connectivity, 
the training was not currently a concern. Because of these 
connectivity problems, OIRA Headquarters officials employed 
other means to obtain the information needed to conduct timely 
and effective export license reviews. Specifically, OIRA 
Headquarters officials obtained initial export license application 
information through the link to ECASS at the Los Alamos National 
Laboratory and obtained any further export license information on 
specific cases through formal and informal means, such as through 
its participation in various interagency groups and periodic contact 
with Commerce officials. 

Accordingly, OIRA Headquarters officials have been able to 
obtain the information necessary for them to conduct their required 
reviews in a timely and effective manner without having access to 
and training on ECASS. OIRA officials advised us that they will 
continue to pursue ECASS connectivity and training. However, as 
discussed above, the recommendations requiring access to and 
training on ECASS have become of limited additional value to 
OIRA’s export license review process. Based upon our current 
review, we closed these two open recommendations. 

We determined that the one recommendation to ensure that export 
control guidance is disseminated and implemented throughout the 
complex should remain open because it is incomplete. 

During April 2004, we issued a report entitled “Contractor 
Compliance with Deemed Export Controls,” DOE/IG-0645, which 
recommended that NNSA ensured that export control guidance, 
including deemed export guidance, was disseminated and 
consistently implemented throughout Energy. Although NNSA 
management had taken some action regarding this 
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recommendation, it had not been fully implemented when we 
initiated this review. 


IMPLEMENTATION OF 
RECOMMENDATION 


REVISION TO 
ORDER 142.3 


We determined that NNSA management should expedite action, 
such as issuing a directive or modifying the DEAR, to fully 
implement the open recommendation to ensure that export control 
guidance is disseminated and consistently implemented throughout 
the Energy complex. 

Based upon our prior recommendation, OIRA initiated several 
export control site reviews and determined that some contractors 
lacked funds and staff to consistently implement the existing 
informal guidance that had been prepared by OIRA in 1999. Also 
based upon this recommendation, OIRA revised existing informal 
export control guidance for dissemination throughout the Energy 
complex. However, Energy and NNSA General Counsel officials 
informed OIRA that issuing revised informal guidance would not be 
the most effective way to ensure consistent export control 
compliance across the Energy complex. OIRA was informed that a 
formal order or possible modification to the DEAR would be more 
effective ways to ensure compliance with export control 
requirements by all Energy and NNSA contractors. 

OIRA prepared a justification for issuing a formal order on export 
controls, which is currently under NNSA management review. 

NNSA is also considering a modification to the DEAR as an 
alternative to issuing an order. We believe that a directive or 
modification to the DEAR would be effective ways to implement 
our recommendation. We, therefore, recommend that NNSA 
management expedite action, such as issuing a directive or 
modifying the DEAR, to implement our prior recommendation. 

We determined that Energy Order 142.3, “Unclassified Foreign 
Visits and Assignments,” should be revised to reflect the current 
Energy process for reviewing foreign national visitors and assignees 
from state sponsors of terrorism. Our prior recommendations 
concerning Energy policy for unclassified foreign visits and 
assignments were closed as a result of the issuance of Order 142.3 and 
will remain closed. However, the process listed in Order 142.3 states 
that all access requests for nationals of countries designated as state 
sponsors of terrorism to unclassified Energy programs, information 
and technology be reviewed by a Headquarters Management Panel. 
The Panel consisted of the Directors of the Energy Offices of Security, 
Counterintelligence, and Intelligence, and representatives designated 
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RECOMMENDATIONS 


MANAGEMENT 

COMMENTS 


INSPECTOR 

COMMENTS 


by the Under Secretary of Energy, Science and Environment and the 
Under Secretary for Nuclear Security/Administrator for the NNSA. 
Since the issuance of this order, Energy reorganized and has a 
structure with three Under Secretaries: the Under Secretary for 
Energy; the Under Secretary for Science; and the Under Secretary for 
Nuclear Security/Administrator for the NNSA. Additionally, the 
Offices of Intelligence and Counterintelligence were consolidated into 
a single Office of Intelligence and Counterintelligence. Consolidation 
of these offices has not substantively affected the review process; 
however, based upon an administrative change to existing Order 142.3, 
representatives of all three Under Secretaries are now part of the panel. 

An Office of Foreign Visits and Assignments official advised that 
the parties involved in the review process determined that it was of 
little value for representatives of all three Under Secretaries to 
participate in every panel review. The official advised that, instead, 
the current practice is to have access requests reviewed by the Office 
of Security, the Office of Intelligence and Counterintelligence, and 
the Under Secretary with cognizance over the program requesting 
access. The official advised that Order 142.3 should be revised to 
reflect the current practice of involving only the cognizant Under 
Secretary in a panel review. Based on the above, we recommend 
that Order 142.3 be revised to reflect Energy’s actual practice. 

We recommend that the Deputy Administrator, Defense Nuclear 
N onprolifer ation: 

1. Expedite actions, such as issuing a directive or modifying the 
DEAR, to ensure compliance with export control requirements 
throughout the Energy complex. 

We recommend that the Chief Health, Safety and Security Officer: 

2. Revise Order 142.3 to reflect the actual process for reviewing 
access requests for nationals of state sponsors of terrorism. 

In comments on our draft report, management agreed with our 
recommendations and identified timelines for completing 
corrective actions. The comments from both organizations are 
included in their entirety at Appendix D. 

We found management’s comments to be responsive to our report 
recommendations. 
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Appendix A 


SCOPE AND 
METHODOLOGY 


We conducted fieldwork for this review in January and 
February 2007. We interviewed Federal and contractor Energy 
officials, including NNSA employees and contractors. We also 
reviewed relevant export control regulations and Energy policies 
relevant to export controls. As part of our review, we evaluated 
Energy’s implementation of the “Government Performance Results 
Act of 1993.” 

This inspection was conducted in accordance with the “Quality 
Standards for Inspections” issued by the President’s Council on 
Integrity and Efficiency. 
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Appendix B 


PRIOR EXPORT CONTROL RELATED REPORTS 


• “The Department of Energy’s Review of Export License Applications for China,” 
DOE/IG-0723, April 2006; 

• “The Department of Energy’s Review of Chemical and Biological Export License 
Applications,” DOE/IG-0682, March 2005; 

• “Contractor Compliance with Deemed Export Controls,” DOE/IG-0645, April 2004; 

• “Safeguards Over Sensitive Technology,” DOE/IG-0635, January 2004; 

• “Inspection of Status of Recommendations from the Office of Inspector General’s March 
2000 and December 2001 Export Control Reviews,” INS-L-03-07, May 2003; 

• “The Department’s Unclassified Foreign Visits and Assignments Program,” 
DOE/IG-0579, December 2002; 

• “Follow-up Inspection of the Department of Energy’s Export Licensing Process for 
Foreign National Visits and Assignments,” INS-L-02-06, June 2002; 

• “Inspection of the Department of Energy’s Automated Export Control System,” 
DOE/IG-0533, December 2001; 

• “Inspection of the Department of Energy’s Role in the Commerce Control List and the 
U.S. Munitions List,” INS-O-01-03, March 2001; 

• “Inspection of the Department of Energy’s Export License Process for Foreign National 
Visits and Assignments,” DOE/IG-0465, March 2000; 

• “The Department of Energy’s Export Licensing Process for Dual-Use and Munitions 
Commodities,” DOE/IG-0445, May 1999; and 

• “Report on Inspection of the Department’s Export Licensing Process for Dual-Use and 
Munitions Commodities,” DOE/IG-0331, August 1993. 
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Appendix C 


STATUS OF RECOMMENDATIONS FROM PRIOR 
NATIONAL DEFENSE AUTHORIZATION ACT REPORTS 


Section 1204 of the National Defense Authorization Act (NDAA) for Fiscal Year 2001 amended 
Section 1402(b) of the NDAA for Fiscal Year 2000 to require the specified Office of Inspectors 
General (OIGs) to include in each annual report the status of the implementation or other 
disposition of recommendations that have been set forth in previous annual reports under Section 
1402(b). To date, seven reports have been completed by the Energy OIG under this requirement. 
Two reports: “Inspection of Status of Recommendations from the Office of Inspector General’s 
March 2000 and December 2001 Export Control Reviews,” INS-L-03-07, May 2003, and 
“Inspection of the Department of Energy’s Role in the Commerce Control List and the U.S. 
Munitions List,” INS-O-01-03, March 2001, did not contain recommendations. The following is 
the status of the recommendations from the other five reports. Of 17 total recommendations, 14 
have already been closed and the remaining 3 are to be closed as a result of this current report. 

“The Department of Energy’s Review of Export License Applications for China,” DOE/IG- 
0723, April 2006 

Recommendation 1 . We recommended that the Deputy Administrator, Defense Nuclear 
Nonproliferation expedite the development and implementation of the new Lawrence Livermore 
National Laboratory database for processing end-user reviews. 

Energy management stated that the end-user database at the Lawrence Livermore National 
Laboratory is up and running to support all new incoming export license applications received 
from Commerce. This database is being enhanced to help ensure a complete search capability 
for entities by incorporating standard names for the facilities names. The Energy OIG agreed to 
close this recommendation. 

Recommendation 2 . We recommended that the Deputy Administrator, Defense Nuclear 
Nonproliferation coordinate with the Director, Office of Intelligence and Counterintelligence 
ensure personnel affiliated with the Office of Defense Nuclear Nonproliferation who conduct 
export license reviews have continual access to Sensitive Compartmented Information computers 
and be able to hand carry Sensitive Compartmented Information documents. 

Energy management stated that both offices have met and coordinated regarding this 
recommendation. Access has subsequently been granted to contractor staff affiliated with the 
Office of Defense Nuclear Nonproliferation to use Sensitive Compartmented Information 
computers and hand carry Sensitive Compartmented Information. The Energy OIG agreed to 
close this recommendation. 
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“The Department of Energy’s Review of Chemical and Biological Export License 
Applications,” DOE/IG-0682, March 2005 

Recommendation 1 . We recommended that the Deputy Administrator, Defense Nuclear 
Nonproliferation take appropriate action to ensure that Energy licensing officers have access to 
the Department of Commerce’s Export Control Automated Support System (ECASS). 

As discussed in the findings section of this report, we are closing this recommendation. 

Recommendation 2 . We recommended that the Deputy Administrator, Defense Nuclear 
Nonproliferation take appropriate action to ensure that Energy licensing officers are properly 
trained in the use of this system. 

As discussed in the findings section of this report, we are closing this recommendation. 

“Contractor Compliance with Deemed Export Controls,” DOE/IG-0645, April 2004 

Recommendation 1 . We recommended that the Director, Office of Security and Safety 
Performance Assurance expedite issuance of a draft unclassified foreign visits and assignments 
Order 142.X that addresses training requirements and responsibilities for hosts of foreign 
nationals. 

Energy management reported that Energy Order 142.3 was approved on June 18, 2004. The 
Energy OIG determined that Energy Order 142.3 included training requirements and 
responsibilities for hosts of foreign nationals and agreed to close this recommendation. 

Recommendation 2 . We recommended that the Deputy Administrator, Defense Nuclear 
Nonproliferation ensure that export control guidance, including deemed export guidance, is 
disseminated and is being consistently implemented throughout the Energy complex. 

As discussed in the findings section of this report, this recommendation will remain open. 

“Inspection of the Department of Energy’s Automated Export Control System,” 
DOE/IG-0533, December 2001 

Recommendation 1 . We recommended that the Assistant Deputy Administrator for Arms 
Control and Nonproliferation coordinate with the Departments of Commerce and Treasury to 
ensure access by Energy to information within the Automated Export System regarding the 
purchase and/or shipment of commodities under an approved export license, and develop 
guidelines for Energy’s access to the information. 

Energy management reported that the National Nuclear Security Administration (NNSA) has 
taken actions as far as its cognizant authority allows. All remaining actions are contingent on 
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other Government agencies. NNSA recommended that the interagency OIG group involved with 
export controls make specific recommendations to individual agencies in order to effect change. 
While actions are not completed, NNSA can no longer report meaningful status. The Energy 
OIG agreed to close this recommendation. 

Recommendation 2a . We recommended that the Assistant Deputy Administrator for Arms 
Control and Nonproliferation coordinate with State to improve communications regarding review 
of export license applications for munitions commodities. 

Energy management reported that NNSA has taken actions as far as its cognizant authority 
allows. All remaining actions are contingent on other Government agencies. NNSA 
recommended that the interagency OIG group involved with export controls make specific 
recommendations to individual agencies in order to effect change. While actions are not 
completed, NNSA can no longer report meaningful status. The Energy OIG agreed to close this 
recommendation. 

Recommendation 2b. We recommended that the Assistant Deputy Administrator for Arms 
Control and Nonproliferation coordinate with State to ensure access by Energy to information 
maintained by State regarding final disposition (i.e., approval/denial of license applications and 
the purchase and/or shipment of commodities) of export license applications and develop 
guidelines for Energy’s access to the information. 

Energy management reported that NNSA has taken actions as far as its cognizant authority 
allows. All remaining actions are contingent on other Government agencies. NNSA 
recommended that the interagency OIG group involved with export controls make specific 
recommendations to individual agencies in order to effect change. While actions are not 
completed, NNSA can no longer report meaningful status. The Energy OIG agreed to close this 
recommendation. 

“Inspection of the Department of Energy’s Export License Process for Foreign National 
Visits and Assignments,” DOE/IG-0465, March 2000 

Recommendation 1 . We recommended that the Acting Deputy Administrator for Defense 
Nuclear Nonproliferation ensure that senior Energy officials work with senior Commerce 
officials to assure clear, concise, and reliable guidance is obtained in a timely manner from 
Commerce regarding the circumstances under which a foreign national’s visit or assignment to 
an Energy site would require an export license. 

Energy management was advised by the Commerce Assistant Secretary for Export 
Administration that extensive guidance regarding compliance with the deemed export rule was 
available on the Commerce Web site and that Commerce would continue to strengthen its 
outreach training programs for Energy’s National Laboratories. The Energy OIG agreed to close 
this recommendation. 
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Recommendation 2 . We recommended that the Director, Office of Security and Emergency 
Operations ensure that a proposed revision of the Energy Notice concerning unclassified foreign 
visits and assignments includes the principal roles and responsibilities for hosts of foreign 
national visitors and assignees. 

Energy management reported that Energy Order 142.3 was approved on June 18, 2004. The 
Energy OIG determined that Energy Order 142.3 included the principal roles and responsibilities 
for hosts of foreign national visitors and assignees and agreed to close this recommendation. 

Recommendation 3 . We recommended that the Director, Office of Security and Emergency 
Operations, include a requirement for Energy and Energy contractor officials to enter required 
foreign national visit and assignment information in the Foreign Access Records Management 
System, or a designated central database, in a complete and timely manner. 

Energy management reported that a new Energy-wide information system, the Foreign Access 
Centralized Tracking System (FACTS), was developed and implemented. Energy management 
further advised that draft Order 142.X includes a requirement for Energy sites to enter required 
foreign national visit and assignment information into FACTS in a complete and timely manner. 

Because Energy management’s corrective action addressed usage of FACTS by all Energy 
Federal and contractor employees, the Energy OIG agreed to close this recommendation and 
track this issue under recommendation 8. 

Recommendation 4 . We recommended that the Manager of Energy’s Oak Ridge Operations 
Office ensure that requests for foreign national visits and assignments at the Oak Ridge site are 
reviewed by the Y-12 National Security Program Office to assist in identifying those foreign 
nationals who may require an export license in conjunction with the visit or assignment. 

Energy management reported that, to ensure requests for foreign national visits and assignments 
at the Oak Ridge National Laboratory receive appropriate export license consideration, Oak 
Ridge National Laboratory initiated a system of reviews. Under the system, requests are 
reviewed by five separate disciplines (Cyber Security, Export Control, Classification, 
Counterintelligence, and Security). In addition, requests associated with concerns are referred 
for resolution to the Non-citizen Access Review Committee. Energy management further 
reported that while each of the reviews can involve the National Security Program Office, the 
Oak Ridge National Laboratory Export Control Officer is responsible for referring requests to 
the National Security Program Office as necessary. The Energy OIG agreed to close this 
recommendation. 

Recommendation 5 . We recommended that the Director, Office of Security and Emergency 
Operations ensure that the requirements in the revised Energy Notice for unclassified foreign 
national visits and assignments are clearly identified and assigned to responsible officials or 
organizations. 
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Energy management reported that Energy Order 142.3 was approved on June 18, 2004. The 
Energy OIG determined that Energy Order 142.3 included clear identification of requirements 
for foreign national visits and assignments, and identifies responsible officials and organizations 
and agreed to close this recommendation. 

Recommendation 6 . We recommended that the Acting Deputy Administrator for Defense 
Nuclear Nonproliferation ensure that guidance issued by the Office of Nuclear Transfer and 
Supplier Policy to advise hosts of their responsibilities regarding foreign nationals includes the 
appropriate level of oversight to be provided by the host during the period of the visit or 
assignment. 

Energy management reported that DOE Order 142.3 was approved on June 18, 2004. The 
Energy OIG determined that Energy Order 142.3 included the principal roles and responsibilities 
for hosts of foreign national visitors and assignees and agreed to close this recommendation. 

Recommendation 7 . We recommended that the Director, Office of Security and Emergency 
Operations revise the Energy policy regarding foreign national visits and assignments to ensure 
that Energy sites are maintaining consistent information about foreign nationals visiting or 
assigned to work at the site. 

Energy management reported that DOE Order 142.3 was approved on June 18, 2004. The 
Energy OIG determined that Energy Order 142.3 included the requirement for documentation in 
FACTS for all visit and assignment requests in a timely manner and agreed to close this 
recommendation. 

Recommendation 8 . We recommended that the Director, Office of Security and Emergency 
Operations require that all Energy sites with foreign national visitors or assignees enter 
information regarding the visits or assignments into Foreign Access Records Management 
System, or a designated central Energy database. 

Energy management reported that DOE Order 142.3 was approved on June 18, 2004. The 
Energy OIG determined that Energy Order 142.3 included the requirement that all sites having 
foreign national visitors or assignees are required to enter information regarding the visits and 
assignments into FACTS and agreed to close this recommendation. 
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Appendix D 



Review of Status of Prior Export Control Recommendations at 
the Department of Energy (SO6IS045) 

The Office of Health, Safety and Security (HSS) has reviewed the subject draft inspection 
report provided by the Inspector General’s Office on April 20, 2007, and provides the 
following comments. 

Recommendation 2 : We recommend that the Chief Health, Safety and Security Officer: 

Revise Order 142.3 to reflect the actual process for reviewing access requests for 
nationals of state sponsors of terrorism. 

Response : 

Concur. The Office of Health, Safety and Security (HSS) has begun the process of 
modifying the Order to reflect the current process of including only HSS, The Office of 
Intelligence and Counterintelligence, and a representative of the cognizant Under 
Secretary in the Headquarters Management Panel advisory review of access requests for 
nationals of state sponsors of terrorism prior to final approval determination by the 
cognizant Under Secretary. HSS will submit a justification for this modification, in line 
with the requirements of DOE Manual 251.1-IB, Departmental Directives Program , in 
May, 2007. 

If you have any questions, you may contact me at (301) 903-3777 or have a member of 
your staff contact Jennifer Emanuelson at (202) 586-6828. 

cc: Richard Speidel, NA-66 
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JNWSH 


Department of Energy 
National Nuclear Security Administration 

Washington, DC 20585 

May 17, 2007 



MEMORANDUM FOR 


FROM: 


SUBJECT: 


Christopher R. Sharpley 
Deputy Inspector Genera! 

for Investigations and Inspections 


Michael C. Kane ^ 

Associate AdminfetratoY 

for Management tuidJUlniinistration 


Comments to Review of Status of Prior 
Export Control Recommendations; 


S07IS045/2007-00568 


The National Nuclear Security Administration (NNSA) appreciates the 
opportunity to review the Inspector General’s (IG) draft report, “Review 
of Status of Prior Export Control Recommendations at the Department of 
Energy.” We understand that this report came about because the National 
Defense Authorization Act for FY 2000 required that from 2000 through 
2007, the IG was to provide a report on the export of technologies with a 
potential military application. During that time NNSA responded to seven 
reports with a corresponding 17 recommendations towards improving our 
export control efforts. 

NNSA appreciates the work conducted by the IG. We acknowledge that 
the IG is closing two of the three remaining recommendations and is 
further recommending that we expedite actions related to the open 
recommendations. One of the possible solutions that we are pursuing is 
the modification of the Department’s Acquisition Regulations. This 
would then require any contractor who has business with the Department 
to comply with Export Controls rules. We will complete the actions to 
ensure the most efficient and effective means to accomplish that which the 
IG is recommending by December 2007. 

Should you have any questions related to this response, please contact 
Richard Speidcl, Director, Policy and Internal Controls Management. 

cc: Will Tobey, Deputy Administrator for Defense Nuclear Nonproliferation 

David Boyd, Senior Procurement Executive 
Karen Boardman, Director, Service Center 
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CUSTOMER RESPONSE FORM 


The Office of Inspector General has a continuing interest in improving the usefulness of its 
products. We wish to make our reports as responsive as possible to our customers’ requirements, 
and, therefore, ask that you consider sharing your thoughts with us. On the back of this form, 
you may suggest improvements to enhance the effectiveness of future reports. Please include 
answers to the following questions if they are applicable to you: 

1. What additional background information about the selection, scheduling, scope, or 
procedures of the inspection would have been helpful to the reader in understanding this 
report? 

2. What additional information related to findings and recommendations could have been 
included in the report to assist management in implementing corrective actions? 

3. What format, stylistic, or organizational changes might have made this report’s overall 
message more clear to the reader? 

4. What additional actions could the Office of Inspector General have taken on the issues 
discussed in this report which would have been helpful? 

5. Please include your name and telephone number so that we may contact you should we have 
any questions about your comments. 


Name _ Date _ 

Telephone _ Organization 


When you have completed this form, you may telefax it to the Office of Inspector General at 
(202) 586-0948, or you may mail it to: 

Office of Inspector General (IG-1) 

Department of Energy 
Washington, DC 20585 

ATTN: Customer Relations 

If you wish to discuss this report or your comments with a staff member of the Office of 
Inspector General, please contact Judy Garland-Smith at (202) 586-7828. 
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Summary 

The Department of State Office of Inspector General (OIG) found, based on its 
review, that the Bureau of Political-M iIitary Affairs, Directorate of Defense Trade 
Controls (PM/DDTC), had implemented 28 of the 29 recommendations contained in OIG 
reports on export controls issued from 2000 to 2006. OIG's recommendation from its 
2006 report that PM /DDTC should establish performance measures that detail 
benchmarks and timeframes for reducing and eliminating the number of unfavorable 
post-license end-use checks remains unresolved. Nevertheless, PM/DDTC stated that 
over the next year it would consider whether such measures, along with time-lines and 
benchmarks, would be of value in its compliance and licensing functions. Asa result, 
this recommendation will remain unresolved until PM/DDTC makes its final 
determination. 

Background 

In response to requirements of Section 1402 of the National Defense 
Authorization Act (N DAA) for FY 2000, 1 the Inspectors General of the Departments of 
Commerce, Defense, Energy, Homeland Security, and State, in consultation with the 
Director of Central Intelligence and the Director of the Federal Bureau of Investigation, 
are required to conduct an annual review through 2007 to assess the adequacy of current 
export controls and counterintelligence measures to prevent the acquisition of sensitive 
U .S. technology and technical information by countries and entities of concern. The 
Offices of Inspector General of these agencies conduct both agency-specific and 
interagency reviews. 

Sound export controls and licensing operations are essential to preventing the 
spread of weapons of mass destruction technologies and to provide conventional 
technologies only to those entities that will use them responsibly. The Department 
registers U .S. companies and universities and issues licenses for the export of defense 
articles and defense services, including sensitive technical information, on the U .S. 

M unitions List (USM L). PM/DDTC is responsible for controlling the export and 
temporary import of defense articles and defense services covered by the U SM L. A 
primary responsibility isto takefinal action on license applications for defense trade 
exports and for addressing matters related to defense trade compliance, enforcement, and 
reporting. 

TheArms ExportControl Act(AECA), as amended in 1996, 2 requires the 
President to establish a program for end-use monitoring of defense articles and services 
sold or exported under the provisions of the A EC A and the Foreign Assistance Act. 3 The 
requirement states that, to the extent practicable, end-use monitoring programs should 
provide reasonable assurance that recipients comply with the requirements imposed by 
the U .S. government on the use, transfer, and security of defense articles and services. In 


1 Public Law 106-65. 

2 22 U .S.C. 2785. 

3 22 U .S.C. 2151. 
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addition, monitoring programs, to the extent practicable, are to provide assurances that 
defense articles and services are used for the purposes for which they are provided. 

To comply with the A EC A, PM/DDTC conducts end-use monitoring of the 
commercial export of defense articles, services, and related technical data. End-use 
monitoring refers to the procedures used to verify that foreign recipients of controlled 
U .S. exports use such items according to U .S. terms and conditions of transfer. 

PM /DDTC's end-use monitoring is conducted through the "BIue L antern" Program and 
entails an in-depth review either before (prelicense) or after (postlicense) the license is 
issued. U.S. embassy or, in some cases, PM/DDTC personnel conduct end-use checks 
abroad to verify the specific use and recipient of commercial defense exports and 
transfers controlled under theAECA. 


Objective, Scope, and Methodology 

To comply with the requirements of the N DA A for FY 2007, the overall objective 
of the Inspectors General, as defined in the Interagency Implementation Agreement, was 
to determine whether management had effectively addressed recommendations contained 
in export control reports required by the N DA A and that were issued between 1999 and 
2007. The 2007 report will contain the results of reviews performed by the I nspectors 
General of the Departments of Commerce, Defense, Energy, Homeland Security, State, 
Treasury, United States Postal Service, and the Central Intelligence Agency. The 
Department of State's objective was to follow up on prior recommendations that 
remained open and determine the actions needed to implement the recommendations. 

To achieve its objective, OIG reviewed the status of each recommendation 
contained in its export control reports issued from 2000 to 2006. (The reports and the 
status of each recommendation are detailed in the Results of Audit section of this report.) 
Additionally, OIG obtained and reviewed current PM/DDTC licensing policies and 
procedures, conducted interviews with appropriate staff, and reviewed applicable 
documentation and system checks. OIG also evaluated the Bureau Performance Plans for 
FY s 2006 and 2008. Finally, OIG discussed the status of each report recommendation 
with PM/DDTC officials. 

To guide OIG's determi nation for the resolution of audit findings and 
recommendations, OIG examined guidance from the Government Accountability Office 
(GAO) concerning the definition of "Open Recommendation" and the standard in regard 
to the length of time that a recommendation should remain open. Additionally, OIG's 
Office of Audits (AUD) M anual, July 2006, Chapter 19, "Audit Resolution," defines 
AUD's policies and procedures for the resolution of audit findings and recommendations. 

OIG's Office of Audits, International Programs Division, conducted this review 
from November 2006 through July 2007 in the Washington, DC, area. OIG performed 
this work in accordance with government auditing standards and included such tests and 
auditing procedures that were considered necessary under the circumstances. 
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Results of Audit 

Based on its review of the audit reports it had issued from 2000 to 2006 on export 
controls, OIG determined that 28 of the 29 recommendations contained in six reports 
(one report did not have any recommendations) 4 had been implemented. The one 
remaining recommendation is unresolved because PM/DDTC officials stated that they 
would consider, over the next year, whether to implement the recommendation. 

Reports With All Recommendations Closed 

All of the recommendations contained in the reports below are considered closed as 
follows: 

• "Department of State Controls Over the Transfer of M ilitary Sensitive 
Technologies to Foreign Nationals From Countries and Entities of Concern" (00- 
CI-008), issued in M arch 2000, contained three recommendations relating to the 
transfer of military sensitive technologies to foreign nationals. OIG found that all 
of the recommendations had been implemented. 

• "U.S. Munitions List and the Commodity Jurisdiction Process" (01-FP-M -027), 
issued in M arch 2001, contained seven recommendations relating to the U SM L 
and the commodity jurisdiction process. OIG found that all of the 
recommendations had been implemented. 

• "Streamlined Processes and Better Automation Can Improve M unitions License 
Reviews" (IT-A-02-02), issued in March 2002, contained four recommendations 
relating to improving the munitions license reviews. OIG found that all of the 
recommendations had been implemented. 

• "Review of End-Use M onitoring of M unitions Exports" (AUD/PR-03-31), issued 
in M arch 2003, contained nine recommendations relating to end-use monitoring 
of munitions exports. OIG found that all of the recommendations had been 
implemented. 

• "Review of Export Controls for Foreign Persons Employed at Companies and 
Universities" (AUD/PR-04-24), issued in April 2004, contained four 
recommendations relating to export controls for foreigners employed at 
companies and universities. OIG found that all of the recommendations had been 
implemented. 

Report With Unresolved Recommendation 

OIG's report"Review of Export Controls" (A U D/I P-07-01), issued in October 
2006, found that although PM/DDTC had followed its policies and procedures before 


4 "Export Licensing of Chemical and Biological Commodities" (AU D/PR-05-29), issued in April 2005. 
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issuing a license, there were instances in which its end-use check, conducted either before 
or after a license was issued, resulted in "unfavorabledeterminations." Unfavorable 
means that PM/DDTC had found derogatory, incomplete, or inaccurate information in the 
license application or there was a violation of export control policies and procedures. 

OIG discussed its report findings and proposed recommendations with PM/DDTC 
officials before it issued its draft report. OIG then provided a copy of the draft report to 
PM/DDTC officials, who reviewed the draft but did not provide comments on it. 
Subsequently, in an October 6, 2006, memorandum to OIG, PM/DDTC officials stated 
that they were "fully considering]" the report's two recommendations. Asa result, both 
recommendations were considered unresolved, which required OIG to follow up on the 
recommendations to determine their statuses. 

Recommendation Closed 

OIG recommended (Recommendation 1) that PM/DDTC reassess its licensing 
policies and procedures and report to OIG within 60 days of report issuance the changes 
it will make to reduce and eliminate unfavorable post-license end-use checks. 

PM/DDTC, in a M ay 14, 2007, e-mail to OIG, said that it was "always willing to 
consider any recommendation that would improve [its] licensing and compliance 
functions." Its response provided a summary of "new and continuing" initiatives "to 
improve upon [its] work product" as follows: 

• Education and Training 

- PM/DDTC said that management from all of its divisions provide periodic 
training to incoming and current licensing staff "to help understand end-use monitoring 
and identify potential cases" and that in 2006 it had issued an updated Blue Lantern 
Guidebook. 

- PM/DDTC also said thatU.S. government staff and management participated in 
educational outreach efforts with federal law enforcement and intelligence communities 
that had "led to the establishment of better working relationships among staff and 
organizations." 

- PM/DDTC said that staff from the Research and Analysis Division (RAD), the 
division that implements the Blue Lantern end-use program, had visited over 20 countries 
in Europe, Asia, Latin America, and the M iddle East to educate these governments on 
U.S. end-use monitoring and to improve their support to U.S. embassy officials. Also, 
PM/DTCC staff and management participate in forums on public training and education, 
including the Blue Lantern Program. 
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• Personnel 

- PM/DTCC said that each licensing division has a compliance specialist from 
RA D who performs compliance duties and that RA D has added another contractor to its 
staff. 


• Information Technology (IT) 

- PM / DTCC said that its personnel and IT staff had developed and implemented 
new Watchlist software that results in a "more user-friendly format and a more efficient 
and effective search tool." It also said that it would begin to develop software that 
supports the Blue Lantern Program "in the winter of 2008" that will be "interoperable 
with existing IT products" and that it plans to implement the software before FY 2009. 
According to PM/DTCC, the software will improve its ability to "research and analyze 
Blue Lantern data to help identify trends and high-risk transactions." 

• Coordination and Staff V isits 

- PM/DTCC said that there would be better coordination among its three divisions 
and that it had made 23 compliance staff visits to U.S. defense companies in FY 2006. 

OIG Analysis 

OIG recognizes the significant enhancements PM/DDTC has both made and 
formulated to its licensing and compliance program and therefore to implement 
Recommendation 1. As a result, OIG considers Recommendation 1 closed. 

Recommendation Unresolved 

In its October 2006 report, OIG recommended (Recommendation 2) that 
PM/DDTC establish performance measures that detail benchmarks and timeframes for 
reducing and eliminating the number of unfavorable post-license end-use checks. 

In its October 6, 2006, response, PM/DDTC said thatitwould "examine whether 
to incorporate the measures already used by DDTC in managing the Blue Lantern 
Program into the Bureau's performance metrics." It also said, in its M ay 14, 2007, e-mail 
to OIG, that it would "over the next year... agree to consider whether such measures, 
along with time-lines and benchmarks, would be of value in ... overall compliance and 
licensing functions." 

OIG Analysis 

OIG believes that the recommendation should be implemented. Performance 
measures for end-use checks could demonstrate progress in reducing and eliminating 
unfavorable determinations. Additionally, PM/DDTC could use the measures to track 
performance, identify areas for improvements, and make decisions about resource 
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allocations. Therefore, the recommendation remains unresolved until PM/DDTC makes 
a final determination. 
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EXPORT CONTROLS: CFIUS and OFAC Implemented Prior 
OIG Recommendations (OIG-07-040) 



OIG 

The Department of the Treasury 
Office of Inspector General 


Audit 

Report 


June 12, 2007 
Clay Lowery 

Acting Under Secretary for International Affairs 
Adam J. Szubin 

Director, Office of Foreign Assets Control 

This report presents the results of an audit we conducted to follow 
up on recommendations from two prior Office of Inspector General 
(OIG) reports on the Department of the Treasury's enforcement of 
controls for the export of militarily sensitive technology to 
countries and entities of concern. We conducted this follow-up 
audit under the auspices of an interagency working group of OIGs 
that focused on federal agencies' implementation of such controls. 1 
The working group was established to help carry out certain 
reporting requirements of the National Defense Authorization Act 
(NDAA) for Fiscal Year 2000, 2 as amended by the NDAA for Fiscal 
Year 2001. 3 

The objective of this audit was to determine whether Treasury had 
effectively implemented recommendations in audit reports issued 
during fiscal years 2000 and 2003. 4 The fiscal year 2000 report 
contained one recommendation, addressed to the Chair of the 
Committee on Foreign Investment in the United States (CFIUS). 

The fiscal year 2003 report contained two recommendations. 


1 The participating agencies for the fiscal year 2007 working group consists of the OIGs of the 
Departments of Commerce, Defense, Energy, Homeland Security, State, Treasury, the United States 
Postal Service, and the Central Intelligence Agency. 

2 Pub. L. 106-65, § 1402, 113 Stat. 798 (Oct. 5, 1999). 

3 Pub. L. 106-398, § 1204, 114 Stat. 1654A-325 (Oct. 30, 2000). 

4 Department of the Treasury Efforts to Prevent Illicit Transfers of U.S. Military Technologies, 
OIG-00-072 (Mar. 23, 2000); Export Enforcement: Numerous Factors Impaired Treasury's Ability to 
Effectively Enforce Export Controls, OIG-03-069 (Mar. 25. 2003). 
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addressed to the Director of the Office of Foreign Assets Control 
(OFAC). The responding Treasury officials concurred with the 
recommendations and outlined actions planned in response to the 
recommendations. 

We conducted our audit fieldwork from December 2006 through 
March 2007. We met with officials of the Office of Investment 
Security, which is part of the Office of International Affairs, and 
OFAC. We also reviewed relevant CFIUS and OFAC 
documentation. Appendix 1 contains a more detailed description of 
our objective, scope, and methodology. 


Results in Brief 

In our 2000 report, we recommended that the CFIUS Chair 
coordinate efforts with other committee members to identify and 
evaluate all sources of available data that could help identify Exon- 
Florio non-filers. After identifying data sources, CFIUS was to 
develop a methodology and establish procedures for using these 
data sources effectively. We found the procedure that CFIUS 
implemented in response to our recommendation was effective. 

In our 2003 report, we recommended that the Director of OFAC 
coordinate with State Department officials to implement an 
automated process to allow both agencies to track the status of 
license determination referrals. We also recommended that the 
Director of OFAC coordinate with Customs officials to ensure that 
OFAC investigative referrals can be linked to Customs' cases. We 
found that OFAC had implemented procedures that fulfilled the 
intent of these two recommendations but had not formalized the 
procedures as written policy. We recommend OFAC develop 
written policy to formalize the procedures. OFAC agreed to 
implement the recommendations in its response to our report. 

We obtained written comments to a draft of this report from the 
Assistant Secretary of International Affairs and the Director of 
OFAC. The comments are provided in appendix 2. 
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Background 


Reporting Under NDAA 

The NDAA for Fiscal Year 2000 requires the President to submit 
annual reports to Congress through fiscal year 2007 on transfers of 
militarily sensitive technology to countries and entities of concern. 
The reports' contents are to include audits by the Inspectors 
General of the Departments of Commerce, Defense, Energy, and 
State of policies and procedures related to the export of 
technologies and technical information to countries and entities of 
concern. 5 The reporting requirement was amended in fiscal year 
2001 to require that the annual interagency report include OIG 
follow-up on the status or disposition of recommendations made in 
earlier reports. 6 

Although Treasury enforces export controls. Treasury OIG was not 
required to participate in the audits mandated by the 2000 and 
2001 laws. Nevertheless, we chose to participate when the 
interagency working group addressed topics specifically relevant to 
the Department's enforcement efforts. The topics scheduled for 
review were decided by the interagency working group in 2000. 

For fiscal year 2007, the interagency working group decided that 
the report would include a review of how effectively agencies had 
addressed recommendations made in previously issued reports. The 
findings in this report represent our contribution to that effort. 

Treasury OIG issued three audit reports in support of the NDAA. 

The reports contained a total of 16 recommendations, but only 3 
remain applicable to Treasury. The other 13 recommendations were 
addressed to management of entities that are no longer part of 
Treasury - the legacy U.S. Customs Service and Bureau 


5 Pub. L. 106-65, § 1402(b)(3), 113 Stat. 798 (Oct. 5, 1999). 

6 Pub. L. 106-65, § 1402, was amended by Pub. L. 106-398, § 1204, 114 Stat. 1654A-325 (Oct. 30, 
2000 ). 
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of Alcohol, Tobacco and Firearms. 7 Of the 3 remaining 
recommendations, 1 was directed to CFIUS and the other 2 to 
OFAC. 

CFIUS 

CFIUS was established in 1975 mainly to monitor and evaluate the 
effect of foreign investment in the United States. The Secretary of 
the Treasury was designated the Chair of CFIUS. 8 In 1988, 
Congress passed the Exon-Florio amendment to the Defense 
Production Act of 1950. 9 The amendment authorized the President 
or his designee to (1) receive voluntary notices from companies 
engaged in transactions subject to Exon-Florio; (2) to determine 
whether a particular acquisition has national security issues; and 
(3) as appropriate, to undertake investigations. The President 
delegated these authorities to CFIUS. Exon-Florio also gave the 
President authority to prohibit or suspend a transaction if necessary 
to protect national security, and the President retained this 
authority. 

In our 2000 report, 10 we found that although CFIUS did deter some 
foreign acquisitions that may have had national security 
implications, it needed to do more to identify nonfilers engaged in 
activities subject to Exon-Florio. Our specific recommendation was 
as follows: 

We recommend that the CFIUS Chair coordinate efforts with other 
Committee members to identify and evaluate all sources of 
available data that can assist in identifying Exon-Florio non-filers. 
Once data sources are identified, CFIUS needs to develop a 


7 The border security and inspection arm of the U.S. Customs Service is now part of the Bureau of 
Customs and Border Protection; the enforcement and investigation arms of the U.S. Customs Service 
and the law enforcement arm of the Immigration and Naturalization Service is now part of U.S. 
Immigration and Customs Enforcement (ICE). Both Customs and Border Protection and ICE are within 
the Department of Homeland Security. The Bureau of Alcohol, Tobacco and Firearms is now within the 
Department of Justice and is known as the Bureau of Alcohol, Tobacco, Firearms and Explosives. 

8 The other CFIUS member agencies are the Departments of State, Defense, Justice, Commerce, and 
Homeland Security; the Office of Management and Budget; the Council of Economic Advisers; the 
National Economic Council; the Office of the United States Trade Representative; the Office of Science 
and Technology Policy; and the National Security Council. 

9 50 U.S.C. App. § 2170. 

10 OIG-00-072. 
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methodology and establish procedures as to how these data 
sources can be effectively used to meet its responsibilities. 


CFIUS concurred with our recommendation. 

OFAC 

OFAC, located within Treasury's Office of Terrorism and Financial 
Intelligence, administers and enforces economic and trade 
sanctions against targeted foreign countries, organizations that 
sponsor terrorism, and international narcotics traffickers, based on 
U.S. foreign policy and national security goals. OFAC regulations 
require exporters, importers, and others under U.S. jurisdiction to 
obtain OFAC licenses before engaging in any type of commercial 
transactions with targeted countries or nationals. 

During our 2003 audit, 11 we found that OFAC sent referrals to the 
State Department for license determinations when OFAC was 
unsure whether to grant licenses to exporters. The State 
Department, however, did not routinely process these referrals 
promptly, resulting in delays in OFAC license approvals. Both State 
Department and OFAC officials attributed the State Department's 
processing delays to (1) mandatory rotation cycles that required 
employees within the Bureau of Economic and Business Affairs, 
Office of Economic Sanctions Policy, to rotate every two years and 
(2) the State Department's lack of an automated system to track 
OFAC referrals. 

We also found during our 2003 audit that OFAC referred 
approximately 30 cases to Customs each year for criminal 
investigation and that Customs initiated its own investigations of 
OFAC export violations. We determined that Customs did not 
always inform OFAC when Customs closed an OFAC investigative 
referral, decided not to take action on an OFAC referral, or initiated 
its own investigation of export violations. In addition. Customs and 
OFAC used different numbers to identify referrals; as a result, 
OFAC officials said they found it difficult to link their referrals to a 
Customs' investigative case number. The failure of Customs to 
notify OFAC officials about closed referrals and investigations 


OIG-03-069. 
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hampered OFAC's ability to assess civil penalties when it was 
determined that criminal prosecution was not warranted. 

As a result of these findings, we made the following two 
recommendations: 

1. The Director of OFAC should coordinate with State Department 
officials to implement an automated process to allow both 
agencies to track the status of license determination referrals. 

2. The Director of OFAC should coordinate with Customs officials 
to ensure OFAC investigative referrals can be linked to 
Customs' cases. 

OFAC concurred with these recommendations. 


Findings and Recommendations 

CFIUS Established and Implemented Procedures to Help 
Identify Nonfilers 

In response to our recommendation, the CFIUS Chair established 
procedures for coordinating with other Committee members to 
identify and evaluate data sources to help identify Exon-Florio 
nonfilers. Specifically, CFIUS members met in May 2000 to identify 
available sources of data and developed a procedure for reporting 
non-notified transactions. The procedure requires CFIUS members 
to provide the Committee Chair with information on transactions 
they believe may be appropriate for review by the Committee under 
Exon-Florio. Upon receipt of the information, the Committee Chair 
is to add public information and develop a list of non-notified 
transactions. This list is then to be circulated to member agencies 
for review. If a CFIUS member believes that the parties in the 
transaction should file, CFIUS is to take appropriate action. This 
procedure has been used by members to identify non-notified 
transactions since 2000. 
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OFAC Has Taken Steps to Track Referrals to Other 
Agencies but Lacks Written Policy 


We found that, in response to our recommendations, OFAC took 
steps to coordinate with the State Department on license referrals 
and with ICE on investigative referrals. 

OFAC Coordination with the State Department 

OFAC established regular meetings with the State Department to 
review license determination referrals and, since 2003, monthly 
meetings have been held and attended by Licensing Officers and 
office Directors. These meetings are used to elevate licensing 
policy issues between OFAC and the State Department. However, 
OFAC did not implement an automated process that allows both 
agencies to access each other's system to track the status of 
licensing determination referrals because it said that the cost was 
prohibitive. According to OFAC personnel, institution of the 
monthly meetings has resolved most of the timeliness issues that 
the recommendation was intended to address. 

OFAC Coordination with ICE 


OFAC has coordinated with ICE and held regular meetings to 
review the status of ICE-initiated investigations and OFAC referrals. 
During these meetings, ICE has provided its active embargo case 
reports to OFAC for review. These reports detail the status of both 
ICE-initiated investigations and OFAC referrals. To link OFAC 
referrals to ICE cases, OFAC assigns case names to their referrals 
and ICE utilizes these OFAC case names in their active embargo 
reports. 

The steps OFAC took to coordinate with the State Department on 
license referrals and with ICE on investigative referrals fulfilled the 
intent of our recommendations. However, OFAC does not have 
written policy in place that formalizes these procedures. The 
meetings with the State Department and ICE represent an 
important internal control, defined in the Government 
Accountability Office's Standards for Internal Control in the Federal 
Government as the plans, methods, and procedures used to meet 
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missions, goals, and objectives. Further, internal control should be 
clearly documented and the documentation should be readily 
available for examination. 12 Without a written policy requiring 
continued coordination with the State Department and ICE, lapses 
in coordination could occur in the future. 

Recommendations 


To help ensure continuity of coordination between OFAC and the 
State Department and OFAC and ICE, we recommend the Director 
of OFAC do the following: 

1. Ensure OFAC develops written policy to formalize the procedure 
of having monthly meetings with the State Department to 
review the status of license determination referrals. 

2. Ensure OFAC develops written policy to formalize the procedure 
of having regular meetings with ICE to review the status of ICE- 
initiated investigations and OFAC referrals. 

Management Response 

OFAC concurred with the two recommendations. OFAC has drafted 
a policy memo to ensure continued implementation of their current 
practice of conducting monthly meetings with the Department of 
State to resolve issues relating to license applications submitted to 
OFAC that involve foreign policy issues. OFAC has also drafted a 
policy memo to ensure continued implementation of their current 
practice of coordinating with criminal law enforcement agencies, 
including ICE, concerning violations of OFAC regulations. OFAC 
was to distribute both policy memos no later than May 30, 2007. 

OIG Comment 


Management's planned actions are responsive to the intent of our 
recommendations. 


12 Government Accountability Office, Standards for Internal Control in the Federal Government, 
GAO/AIMD-OO-21.3.1 (November 1999). 
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We appreciate the courtesies and cooperation provided to our staff 
during the audit. If you wish to discuss the report, you may 
contact me at (202) 927-5400 or Alain Dubois, Director of Banking 
Audits, at (202) 927-0382. Major contributors to this report are 
listed in appendix 3. 


Marla A. Freedman 

Assistant Inspector General for Audit 
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Objective, Scope, and Methodology 


Our objective was to determine whether certain prior OIG 
recommendations directed to the Chair of the Committee on 
Foreign Investments in the United States (CFIUS) and to the 
Director of the Office of Foreign Assets Control (OFAC) had been 
implemented. These recommendations are restated on pages 6 
and 8. 

To accomplish this objective, we performed the following activities: 

• Conducted interviews with Office of Investment Security 
personnel 

• Reviewed CFIUS guidance on non-notified transactions 

• Conducted interviews with current OFAC managers and one 
former OFAC manager 

• Reviewed and analyzed an OFAC report on all outstanding 
referrals to the State Department 

• Reviewed OFAC documentation related to monthly meetings 
with the State Department 

• Reviewed a U.S. Immigration and Customs Enforcement 
report on Active Embargo Cases 

We performed our audit from December 2006 through March 2007 
in accordance with generally accepted government auditing 
standards. 
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Appendix 2 

Management Comments 



June 4, 2007 


Marla A. Freedman 
Assistant Inspector General for Audit 
Office of the Inspector General 
Department of the Treasury 
740 IS'” Street,N.W., Suite600 
Washington, D.C. 20220 

Dear Ms. Freedman: 

This to acknowledge receipt of the draft audit report you. sent me on May 3: Export 
Controls: CF1US and OFAC Implemented Prior OIG Recommendations. I am pleased to 


learn your office’s view that the Committee on Foreign Investment in the United States 
(CFIUS) has implemented effective procedures in response to the prior audit report’s 
recommendations, and that there are no further recommendations directed to CFIUS. 
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DEPARTMENT OF THE TREASURY 
WASHINGTON, D.C. 20220 


FAC No GEN- 343251 

MEMORANDUM FOR MARLA A. FREEDMAN 

ASSISTANT INSPECTOR GENERAL FOR AUDIT 
OFFICE OF INSPECTOR GENERAL 

FROM: ADAM J. SZUBIN^ 

DIRECTOR 

OFFICE OF FOREIGN ASSETS CONTROL 

SUBJECT: OFAC Comments on the OIG Draft Audit Report - OFAC 

Implementation of Prior OIG Recommendations. 

OFAC has received and reviewed, the draft audit report “Export Controls - CFIUS and 
OFAC Implemented Prior OIG Recommendations,” which was attached to your letter 
dated May 3,2007. It concerns the implementation of prior OIG recommendations 
previously contained in report: “OIG-03-069, Export Enforcement - Numerous Factors 
Impaired Treasury’s Ability to Effectively Enforce Export Controls.” I am hereby 
submitting OFAC’s response to the recommendations contained in your draft audit 
report. Pursuant to OFAC’s review of the report and our recent discussions with you on 
the details of your recommendations, OFAC concurs with the recommendations as noted 
below: 

1. “Ensure OFAC develops written policy to formalize the procedure of having monthly 
meetings with the State Department to review the status of license determination 
referrals.” 

OFAC has drafted a policy memo to be disseminated to OFAC’s Licensing Division 
employees. It will ensure continued implementation of our current practice of 
conducting monthly meetings with the Department of State to resolve issues relating to 
license applications submitted to OFAC that involve foreign policy issues. Distribution 
of the memo will take place no later than May 30, 2007. 

2. “Ensure OFAC develops written policy to formalize the procedure of having regular 
meetings with ICE to review the status of ICE-initiated investigations and OFAC 
referrals.” 

OFAC has drafted a policy memo to be disseminated to OFAC’s Enforcement Division 
employees. It will ensure continued implementation of our current practice of 
coordinating with criminal law enforcement agencies, including ICE, concerning 
violations of OFAC regulations. Distribution of the memo will take place no later than 
May 30, 2007. 

If we can be of any further assistance or if you have any questions, please contact Dale 
Thompson, Chief, General Investigations and Field Operations, at 622-1523. 
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Appendix 3 

Major Contributors To This Report 


Alain Dubois, Director, Banking Audits 
Jeffrey Dye, Audit Manager 
Amnoiphorn Bannavong, Program Analyst 
Bobbie Gambrill, Auditor 
Esther Tepper, Communications Analyst 
Horace Bryan, Referencer 
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Report Distribution 


The Department of the Treasury 

Office of Strategic Planning and Performance Management 
Office of Accounting and Internal Control 

Office of International Affairs 

Office of International Affairs 
Liaison Officer 

Office of Foreign Assets Control 

Office of Foreign Assets Control 
Liaison Officer 

Department of Defense 

Department of Defense Office of Inspector General 

Office of Management and Budget 

OIG Budget Examiner 
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Appendix G. United States Postal Service Report 


G-l 




Office of Inspector General 
United States Postal Service 



March 29, 2007 
PAUL E. VOGEL 

MANAGING DIRECTOR, GLOBAL BUSINESS AND SENIOR VICE PRESIDENT 

SUBJECT: Management Advisory - Follow-up of the Postal Service's 

Enforcement of Export Controls (Report Number SA-MA-07-001) 

This report presents the results of our follow-up review of the U.S. Postal Service's 
enforcement of export controls (Project Number 07YV001SA000). We conducted this 
review as part of an interagency group of Inspectors General 1 to determine whether 
each agency's management had effectively addressed recommendations in prior 
reports on enforcing export controls. 


Background 

Each year companies in the U.S. export billions of dollars worth of dual-use items 2 with 
both commercial and military applications. For example, dual-use items can be 
incorporated into golf clubs but can also help missiles evade radar detection. 3 To 
protect U.S. interests and limit illegal exports, Congress authorized the President to 
prohibit or curtail the export of any goods or technology subject to the jurisdiction of the 
U.S. orexported by any person of the U.S underthe Export Administration Act. 4 The 
Secretary of Commerce exercises this authority in consultation with other departments 
and agencies, as the Secretary considers appropriate, and issues Export Administration 
Regulations (EAR) 5 to carry out this law. 

The EAR requires exporters to obtain a license or determine that government 
authorization is not needed before exporting controlled items. In a 1999 export 
licensing review, the Department of Commerce Office of Inspector General (OIG) raised 
the concern that individuals could circumvent export control laws by sending, through 


^he Inspectors General from the Departments of Commerce, Defense, Energy, Homeland Security, State, 
Treasury, the U.S. Postal Service, and the Central Intelligence Agency comprise this year's interagency review team. 

2 Dual-use items include commodities, software, and technology. 

3 U.S. Government Accountability Office, Export Controls: Improvements to Commerce’s Dual-Use System Needed 
to Ensure Protection of U.S. Interests in the Post-9/11 Environment, J une 2006. 

4 50 U.S.C. App. §§ 2401 etseq. The EAA is not permanent legislation. Authority granted underthe act lapsed in 
August2001 but was extended under Executive Order Number 13,222 (Aug. 17, 2001) and Continuation of 
Emergency Regarding ExportControl Regulations, 71 Fed. Reg. 44,551 (Aug. 7, 2006). 

5 15 C.F.R. Parts 730-774. 
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the U.S. mail, controlled commodities to countries or entities of concern without seeking 
an export license. 

The Department of Commerce, Bureau of Industry and Security's Office of Export 
Enforcement (OEE) and the Department of Homeland Security, Bureau of Customs and 
Border Protection (Customs) are both responsible for export enforcement activities 
related to dual-use items; 6 however, Customs is the primary inspector of items to be 
exported. 

Since Customs has a major role in enforcing export controls and coordinates 
enforcement activities concerning outbound mail with the Postal Service, the Inspectors 
General for both agencies participated in a 2002 interagency review of federal export 
enforcement efforts government-wide. The objective of the Postal Service OIG's review 
was to determine the role of the Postal Service in enforcing export controls. We 
participated in this 2006 interagency follow-up effort to determine whether management 
effectively addressed recommendations made in our previous report, discussed below 
in the Prior Audit Coverage section. 

The Postal Service processes international mail at five International Service Centers 
(ISC). The ISCs are located in New York, Miami, Chicago, Los Angeles, and San 
Francisco. Customs employees are co-located at each ISC and focus on inspecting 
inbound international mail. 

Objectives, Scope, and Methodology 

Our objectives were to determine whether the Postal Service implemented 
recommendations made in the prior report and whether corrective actions are working 
as intended. We reviewed applicable criteria, including the Postal Service's 
International Mail Manual, Administrative Support Manual (AS M), and Domestic- 
Originating International Mail Standard Operating Procedures; the Trade Act of 2002; 8 
the Export Administration Act; and EAR. We also interviewed officials from the Postal 
Service, Postal Inspection Service, Customs, and Department of Commerce, OEE. 

We conducted this review from December 2006 through March 2007 in accordance with 
the President's Council on Integrity and Efficiency, Quality Standards for Inspections. 
We discussed our observations and conclusions with management officials on March 1, 
2007 and included their comments where appropriate. We made no recommendations 
in this report and Postal Service management was not required to provide written 
comments. 


6 Other entities responsible for enforcement activities include the Department of Homeland Security, Immigration and 
Customs Enforcement Division; Department of J ustice, Federal Bureau of Investigation; and the U.S. Attorney's 
Office. 

7 Customs personnel are also co-located at seven other postal facilities nationwide that process international mail. 

8 Pub. L. No. 107-210, § 344 (2002). 
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Prior Audit Coverage 

The 0IG report titled, Review of the Postal Service’s Enforcement of Export Controls 
(Report Number AO-MA-03-001 (R), April 17, 2003), stated that the Postal Service's 
enforcement of export controls could be strengthened. The report recommended that 
the Postal Service finalize and implement an agreement allowing Customs to expand 
and make permanent the outbound mail inspection program; ensure that any outbound 
mail inspection program provides for inspection of items declared for export, according 
to the EAR; and establish a working group to coordinate with the Department of 
Commerce, OEE on export enforcement issues for mail. Postal Service management 
neither agreed nor disagreed with our recommendations; however, their comments 
were responsive and their actions taken and planned should have corrected the issues 
we identified. 


Results 


The Postal Service has taken actions to address OIG recommendations made in 2003. 
Specifically, the Postal Service worked with Customs to develop procedures for an 
outbound mail inspection program. The Postal Service also revised its policy to assist 
Customs in complying with its export enforcement responsibilities, and is currently 
working with Customs on an Outbound Mail Manifest Pilot for inspection of outbound 
international mail. Additionally, the Postal Inspection Service has recently reestablished 
contact with the Department of Commerce, OEE to exchange information on export 
enforcement issues. 

Although the Postal Service and Customs have worked to address compliance with 
export regulations, a nationwide outbound mail inspection program does not exist. 
Because of recent terrorist acts, continuous threats, and a related focus on preventing 
the proliferation of weapons of mass destruction, both agencies must continue to work 
together to expand and implement a program to search outbound international mail and 
ensure compliance with the EAR. 

Finalize Outbound Mail Inspection Program 

The Postal Service worked with Customs to establish and finalize an outbound mail 
inspection program. In February 2003, Customs issued a memorandum to its field 
offices allowing ports to conduct searches of outbound mail shipments as part of 
enforcement operations. The memorandum, which was prepared in coordination with 
the Postal Service, provided guidance on working with Postal Service officials and 
examining outbound mail. It also discussed the criteria Customs should use when 
inspecting different types of outbound mail. 

According to a Customs official, the memorandum permitted each Customs port director 
to establish an outbound mail inspection program based on that port's resources and 
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threat assessment priorities. However, because of resource constraints, no programs 
were implemented at that time. Customs did not attempt to establish a national 
program in collaboration with the Postal Service until 2006. 

Revision to Postal Service Policy . The Postal Service also revised ASM 13 to allow 
Customs to execute its export enforcement responsibilities and implement an outbound 
mail inspection program. Specifically, ASM 13, Sections 274.912-913, provide 
guidance on Customs' authority to open and inspect outbound international mail to 
ensure compliance with federal laws and regulations. In accordance with the law, 9 the 
policy states thatCustoms can inspect outbound mail weighing more than 16 ounces. It 
also provides guidance on Customs' authority to screen international transit mail that is 
handled by the Postal Service and mail that is handled by airlines or other carriers 
without the direct intervention of the Postal Service. 

Outbound Mail Manifest Pilot . The Postal Service is currently working with Customs to 
establish a nationwide outbound mail inspection program. In J une 2006, the Postal 
Service and Customs implemented an Outbound Mail Manifest Pilot atthe Chicago ISC 
to facilitate Customs inspections of outbound mail. 10 The pilot, which consists of three 
phases, * 11 allows the Postal Service to electronically provide Customs with advance 
manifest information on outbound mail shipments of Air Parcel Post and Global Express 
Mail® 12 submitted on-line through the Postal Service's Click-N-Ship® function atthe 
Internet site, www.usos.com . Customs uses a risk management approach to target 
selected shipments for further examination. This system allows Customs to perform 
fewer manual inspections and instead use a more selective and systematic method for 
screening outbound mail. However, according to a Postal Service official, mail 
submitted through the Internet site represents only about 5 percent of all outbound 
international mail, and the majority of this mail is sent through Postal Service retail 
windows. Postal Service and Customs officials are working togetherto implement a 
nationwide outbound mail inspection program that will comply with export laws and 
regulations. 

Ensure Outbound Mail Inspection Program Is in Accordance with Export 
Administration Regulations 

The Postal Service does not have the authority to execute an outbound mail inspection 
program in accordance with the EAR. Although the EAR grants Postal Service officials 
the authority to inspect items declared for export, 13 the Postal Service is prohibited by 


9 19 U.S.C. § 1583(c). 

10 The pilot began in j une 2006; however, it was suspended in September 2006 at Customs' request. The pilot 
entered the final phase in February 2007. 

11 Phase 1 was for data collection only and tested the flow of electronic information between the Postal Service and 
Customs. Phase 2 tested the physical process of holding mail items for Customs. Phase 3 will complete the process 
and allow the pilot operation to run full course. 

12 Effective May 6, 2007, Air Parcel Post will be Priority Mail International and Global Express Mail will be Express 
Mail International®. 

13 15 C.F.R.§ 758.7(a). 
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law from opening mail that is sealed against inspection without a warrant, unless 
exigent circumstances exist (for example, where the screening of the mail has disclosed 
the presence of materials that pose a physical threat to persons or property). 14 This 
statute applies to both mail delivered inside the U.S. and its territories, as well as 
domestic mail being exported. 15 As a result, Postal Service policy does notallow its 
officials to randomly open and examine the contents of mail declared for export. 

Customs is the entity authorized to open and inspect outbound mail. A Customs officer 
may, without a search warrant, search outbound international mail that weighs more 
than 16 ounces and is sealed against inspection if there is reasonable cause to suspect 
that the mail contains items such as monetary instruments, weapons of mass 
destruction, narcotics, or merchandise mailed in violation of the Export Administration 
Act. 16 Outbound international mail that weighs less than 16 ounces and is sealed 
against inspection may not be searched by Customs without a search warrant. 17 

Establish Liaison with Department of Commerce 

The Postal Inspection Service recently reestablished contact with the Department of 
Commerce, OEE in response to our 2003 recommendation. During ourfollow-up 
review, Postal Inspection Service officials informed us that the original liaison had been 
transferred and a new point of contact had not been established. However, in J anuary 
2007, the Inspector In Charge of Dangerous Mail Investigations and Homeland Security 
sent a letter to the Director, Department of Commerce, OEE to introduce himself and 
provide a point of contact for coordination on export enforcement issues. 

Conclusion 


The Postal Service has a cooperative relationship with Customs and has taken 
appropriate actions to assist Customs with its responsibility to search outbound 
international mail and ensure compliance with the EAR. Although both agencies have 
taken measures to strengthen the enforcement of export controls concerning the mail, a 
national outbound mail inspection program has not been implemented. The outbound 
mail manifest program is currently a pilot at only one of the five ISCs. Additionally, the 
pilot is limited to Air Parcel Postand Global Express Mail submitted on-line through the 
Postal Service's Click-N-Ship function at www.usos.com . which, according to a postal 
official, is only 5 percent of all outbound international mail. 

We strongly encourage the Postal Service to continue to work with Customs to expand 
the pilot program nationwide and include other classes of mail as well as mail that is 
presented at retail windows. Not examining more outbound mail on a national or 


14 39 U.S.C. § 3623(d). 

15 39 U.S.C. § 3623(d) authorizes the Postal Service to open mail withouta search warrantforthe sole purpose of 
determining an address at which the letter can be delivered, or pursuant to the authorization of the addressee. 
However, this authority does not extend to conducting random searches of domestic mail that will be exported. 

16 19 U.S.C. § 1583(c)(1). 

17 |dJ 1583(d). 
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systematic basis, could allow illegally exported items to be shipped using the Postal 
Service. Such items could jeopardize security in the U.S. and abroad. 

We appreciate the cooperation and courtesies provided by your staff during the review. 
If you have any questions or need additional information, please contact Andrea 
Deadwyler, Director, Inspection Service and Facilities, or me at (703) 248-2100. 




Tammy L. Whitcomb 
Deputy Assistant Inspector General 
for Support Operations 


cc: Alexander E. Lazaroff 
Lawrence Katz 
Mary Anne Gibbons 
Deborah A. Kendall 
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